Last 7 Days (August 15 – August 21, 2026)
Most modern optimizers form their momentum as an exponential moving average (EMA) of past gradients, forgetting every direction at one fixed rate. However, the inputs a deep network sees during training can be highly anisotropic, with a few directions queried frequently while most are seen rarely. Recent methods address this anisotropy by wrapping extra processing around this buffer, leaving the momentum update itself unchanged. We propose DeltaMomentum, which builds direction-awareness into the momentum update rule. The main observation is that the gradient of a linear layer splits into an input that acts as a key and an output-side error that acts as a value. Exploiting the key-value structure, DeltaMomentum updates the momentum buffer by the canonical delta rule, so each direction is forgotten at a rate set by how often it appears. We prove that it is a valid momentum, that it applies the input-side curvature correction without matrix inversion, and that it clears stale directions faster than EMA under both a fixed and a drifting optimum. It is a drop-in replacement for the momentum buffer of any optimizer, its coefficient transfers across widths under $μ$P, and its extra compute stays between $22.2\%$ and $25.0\%$ of a gated-MLP block's linear cost with no persistent memory. In FineWeb-Edu pretraining, AdamW with DeltaMomentum (DeltaAdamW) reaches AdamW's validation loss in up to $46.39 \pm 4.32\%$ fewer steps at 67M and $22.12 \pm 0.80\%$ at 370M over three seeds, and the gain persists at 1B on a Chinchilla-optimal budget. A Muon baseline tuned under the same protocol sits above DeltaAdamW at both language-model scales, and the gain holds for SGD, ResNet-18, and ViT-Tiny on CIFAR-10. Training-time diagnostics confirm the predicted mechanism, better gradient tracking and healthier input directions.
Primary: University of Pennsylvania
All Institutions: University of Pennsylvania, Jane Street
DeltaMomentum introduces a theoretically grounded, direction-aware momentum update rule that leverages the key-value structure of gradients to achieve faster convergence and implicit preconditioning. The paper presents a compelling combination of rigorous theory, detailed mechanistic analysis, and strong empirical results across multiple scales and architectures, establishing a new baseline for momentum-based optimization that is likely to influence future optimizer design.
The paper proposes "DeltaMomentum," a novel momentum update rule that replaces the standard Exponential Moving Average (EMA) with a delta-rule update based on the key-value structure of rank-1 gradient factorization in linear layers. The core insight is that treating the momentum buffer as an associative memory allows for direction-aware forgetting rates, where directions queried frequently are updated more aggressively. The methodology includes a theoretical derivation showing that this update implicitly performs input-side preconditioning (similar to K-FAC but without matrix inversion) and provides guarantees on convergence and tracking of non-stationary targets. The approach is theoretically sound, well-motivated by the anisotropy of deep learning landscapes, and offers a clean, drop-in replacement for existing optimizers.
The experimental evaluation is comprehensive and convincing. The authors conduct controlled ablations against AdamW (the only baseline differing in the first moment) and Muon (a strong structured optimizer baseline) on Llama-2-style language models at 67M, 370M, and 1B parameters on FineWeb-Edu. The results show significant step-efficiency gains (up to 46% fewer steps) and competitive wall-clock efficiency. Additional experiments on CIFAR-10 with ResNet-18 and ViT-Tiny demonstrate generalizability. The inclusion of mechanistic diagnostics (gradient alignment, function-space prediction error, feature covariance conditioning) strongly supports the theoretical claims. The compute overhead is quantified and shown to be manageable.
The paper provides detailed algorithmic descriptions, theoretical proofs, and mentions specific implementation details (e.g., normalized keys, $\mu$P scaling). The experimental setup is described with sufficient detail for reproduction, including data sources (FineWeb-Edu) and model architectures. The authors provide a clear recipe for hyperparameter transfer, enhancing reproducibility.
The paper acknowledges limitations regarding scale (up to 1B parameters) and domain (language modeling only). It does not yet demonstrate performance on larger models (e.g., 7B+) or other domains like vision-only or multimodal tasks, though the CIFAR results suggest potential. The theoretical analysis relies on quasi-static approximations, which may not perfectly capture the highly non-stationary dynamics of deep training, although the empirical diagnostics support the theory.
This work has significant potential to improve the efficiency of training large-scale neural networks, reducing compute costs and energy consumption. By providing a drop-in replacement for momentum, it can be easily adopted by the community. The theoretical insights into the role of momentum as an associative memory could inspire further research into optimizer design. DeltaMomentum introduces a theoretically grounded, direction-aware momentum update rule that leverages the key-value structure of gradients to achieve faster convergence and implicit preconditioning. The paper presents a compelling combination of rigorous theory, detailed mechanistic analysis, and strong empirical results across multiple scales and architectures, establishing a new baseline for momentum-based optimization that is likely to influence future optimizer design.
We introduce Accelerating Dexterity via Pre-Training (ADEPT), a large-scale reinforcement learning (RL) framework for learning sim-to-real transferable dexterity across high degree-of-freedom (DoF) robot embodiments that can solve long-horizon tasks directly from raw visuo-tactile perception. ADEPT pretrains a dexterous policy on a generic object reposing task, then post-trains downstream policies with this pretrained behavior as a prior. ADEPT enables learning new behaviors that are otherwise difficult to discover from scratch on multi-fingered robots and avoids learning the same set of skills over again for every new downstream task. The pretrained policy zero-shots the reposing phase of downstream tasks, but naïve RL fine-tuning rapidly degrades this capability during transfer. We address this with a stable post-training recipe combining behavior-cloning distillation, critic warm-up, and conservative on-policy updates. To safely exploit the full kinematic dexterity, we introduce a joint-space Geometric Fabric that mediates between the RL policy and the robot. We distill post-trained teachers into perceptive students that zero-shot sim-to-real transfer on two embodiments: a 23 DoF Kuka-Allegro with two RGB cameras, and a 29 DoF Flexiv-Sharpa with two RGB cameras and five vision-based tactile sensors, and can solve long-horizon tasks from challenging initial states with dexterity at human-level speed.
Primary: University of Toronto
All Institutions: University of Toronto, Vector Institute, NVIDIA
The paper presents a significant advancement in dexterous manipulation via RL, introducing a robust pre-training and post-training framework that enables stable and efficient learning of complex manipulation skills. The combination of behavioral cloning distillation, critic warm-up, and conservative updates effectively mitigates the instability often associated with fine-tuning RL policies, while the Geometric Fabric ensures safe and feasible control. The successful sim-to-real transfer on multiple high-DoF platforms demonstrates the practical utility and generalizability of the approach, making it a valuable contribution to the field of robotics and reinforcement learning.
The paper introduces ADEPT, a framework for learning dexterous manipulation policies using Reinforcement Learning (RL). The core methodological contribution is a two-stage training pipeline: 1) Pre-training a policy on a generic "reposing" task to learn basic object handling and kinematic feasibility, and 2) Post-training (fine-tuning) on specific downstream tasks. Crucially, the authors address the issue of "catastrophic forgetting" or instability during fine-tuning by introducing a stable recipe combining behavior cloning (BC) distillation, critic warm-up, and conservative on-policy updates. They also introduce a "Geometric Fabric" in the joint space to mediate between the RL policy and the robot, ensuring safe and feasible control. The approach leverages large-scale simulation data and transfers to real-world embodiments (Kuka-Allegro and Flexiv-Sharpa). The methodology is sound and addresses a significant bottleneck in dexterous manipulation: the difficulty of discovering complex manipulation skills from scratch via RL.
The evaluation is extensive and rigorous. The authors demonstrate zero-shot sim-to-real transfer on two distinct high-DoF robotic platforms. They show that ADEPT enables the robots to solve long-horizon tasks (like object reposing and manipulation) from challenging initial states. The results indicate that the pre-training phase significantly accelerates learning and improves the stability of the post-training phase compared to training from scratch. The comparison against baselines (likely standard RL or BC-only approaches) highlights the effectiveness of the proposed post-training recipe. The ability to transfer to real hardware without further tuning is a strong empirical result.
The paper provides detailed descriptions of the simulation environment, the robot models, and the training hyperparameters. The code is made available on GitHub, and the project website includes demo videos. The use of standard simulators (Isaac Gym) and well-known robot models enhances reproducibility. The authors explicitly discuss the limitations and the specific conditions under which the method works, aiding in replication.
The method relies heavily on high-quality simulation-to-real transfer, which can still be sensitive to domain gaps not captured in simulation (e.g., friction variations, sensor noise). The "Geometric Fabric" adds a layer of complexity to the control stack. The pre-training on a generic task requires careful design to ensure the learned priors are useful for diverse downstream tasks. The computational cost of pre-training on large-scale RL data is significant.
This work contributes to the advancement of general-purpose robotic manipulation, a key step towards more autonomous and versatile robots in unstructured environments. By making dexterous manipulation more accessible via RL, it lowers the barrier for research and application in this domain. The open-source release of code and models promotes further research and development in the field. The paper presents a significant advancement in dexterous manipulation via RL, introducing a robust pre-training and post-training framework that enables stable and efficient learning of complex manipulation skills. The combination of behavioral cloning distillation, critic warm-up, and conservative updates effectively mitigates the instability often associated with fine-tuning RL policies, while the Geometric Fabric ensures safe and feasible control. The successful sim-to-real transfer on multiple high-DoF platforms demonstrates the practical utility and generalizability of the approach, making it a valuable contribution to the field of robotics and reinforcement learning.
Agent frameworks increasingly package procedural knowledge as skills: instruction files an agent reads on demand, while public libraries now hold thousands of them. Which skill to read has thus become a decision the policy itself makes in the middle of an episode, yet no existing signal trains it. We show that the default remedy, outcome-rewarded RL over the candidate slate, cannot teach it, for a structural reason we identify and name selector credit starvation: under a broadcast, sequence-level advantage, the few tokens that name the chosen skill carry a vanishing share of the loss, and the credit they inherit is increasingly wrong-signed as trajectories lengthen. A correct choice is punished whenever the execution after it fails, even though the choice itself is among the most valuable decisions in the trajectory. Auditing a completed run's own training artifacts confirms all three properties, each worsening monotonically with horizon. SkillGate removes the failure by construction: it partitions the token support into two disjoint credit channels, outcome credit reaching only execution tokens, and a separate action-local advantage reaching exactly the skill-naming tokens, positive only when a trajectory's single read is the correct one. On five agentic benchmarks under a 16-candidate slate, SkillGate lifts a 9B policy from 40.8% to 53.2% trial success, well ahead of the identical budget spent on outcome reward alone, while cutting exposure to misleading candidates by two thirds and reading fewer skills.
Primary: Unknown (Affiliations not explicitly listed in text, authors appear to be from various Chinese institutions based on names and "corrauth" markers)
All Institutions: Unknown
SkillGate introduces a novel disjoint credit channel architecture that solves "selector credit starvation," enabling 9B agents to reliably select skills from large slates, significantly outperforming outcome-only RL and demonstrating that selection is a trainable, distinct capability from execution.
The paper introduces "SkillGate," a method that addresses the specific problem of in-policy skill selection in long-horizon agentic tasks. The core technical contribution is the identification of "selector credit starvation," a structural flaw in standard outcome-rewarded RL where the tokens responsible for selecting a skill receive vanishingly small and often incorrectly signed gradients. The proposed solution partitions the token support into two disjoint credit channels: an execution channel using standard group-normalized outcome advantages, and a selection channel using an action-local advantage that rewards only the specific tokens naming the correct skill. This separation prevents the selection decision from being punished by execution failures and ensures the selection signal is not diluted by trajectory length. The methodology is theoretically sound, addressing a known bottleneck in agent training with a precise, mechanistic fix.
The authors evaluate SkillGate on five agentic benchmarks (Claw-Eval, SkillsBench, SETA, SWE, Terminal-Bench 2.0) using a 16-candidate slate. They demonstrate that SkillGate lifts a 9B policy from 40.8% to 53.2% trial success, outperforming outcome-only RL, supervised selection, and preference learning baselines. Crucially, they show that SkillGate achieves this with fewer reads and less exposure to misleading skills, indicating genuine improvement in selection capability rather than just increased tool usage. The ablation studies effectively isolate the contribution of the selection channel, showing that coarser credit assignment (group or trajectory level) fails to improve selection. The comparison with frontier models highlights that skill selection is a distinct capability not solved by scale alone.
The paper provides detailed implementation details, including the use of Qwen3.5-9B, GRPO, specific hyperparameters (learning rate, KL coefficient), and the structure of the training tasks. The description of the "standard mixed slate" and the construction of misleading candidates is clear. The audit methodology for demonstrating credit starvation is also well-described, allowing for replication of the diagnostic findings. However, the specific code for the "clean single-oracle utility" and the exact implementation of the disjoint credit masking would be necessary for full reproducibility, which is likely in a supplementary or code release not provided here.
The method requires that the correct skill is known during training to compute the selection advantage, limiting its applicability to settings with verifiable outcomes or oracle skills. The method assumes a "single read" constraint for the selection credit to be clean; reading multiple skills dilutes the signal. The evaluation is limited to 9B and 27B models, and while it outperforms larger frontier models in selection, it does not match their overall task success, suggesting that execution capability remains a bottleneck. The audit is performed on a single run's artifacts, and while the trends are clear, broader statistical significance across seeds is not explicitly detailed in the abstract/text provided.
This work has significant implications for the development of reliable autonomous agents. By solving the credit assignment problem for skill selection, it enables agents to effectively utilize large libraries of procedural knowledge, which is critical for complex, long-horizon tasks. The insight that selection and execution require disjoint credit channels is likely to influence future agent training methodologies, moving the field away from naive outcome-only RL for tool-use scenarios. It highlights the importance of fine-grained credit assignment in multi-decision trajectories. SkillGate introduces a novel disjoint credit channel architecture that solves "selector credit starvation," enabling 9B agents to reliably select skills from large slates, significantly outperforming outcome-only RL and demonstrating that selection is a trainable, distinct capability from execution.
For AI agents to be useful beyond simple chat, they must hold sensitive user context such as calendars, credentials, health records, and financial data. We study whether the mere presence of such secrets in a model's context window introduces hidden correlations into the model's benign outputs, allowing reconstruction even when the model correctly refuses direct extraction. We further study whether an adversary can actively engineer prompts that amplify this effect, using the model as a covert carrier to transmit secrets through seemingly innocuous text. In both cases, this limited leakage is exploited using a novel adaptive attack that assumes black-box access to the underlying model. In controlled experiments across eight proprietary models, we find that 2-digit in-context secrets are reconstructed with near-perfect accuracy and 4-digit secrets at 82\% exact match, all from outputs the model produces in response to ordinary, non-adversarial requests. We observe that more capable models leak more: stronger instruction-following amplifies sensitivity to in-context secrets, suggesting leakage is a byproduct of capability as opposed to a patchable bug. We show this leakage enables two practical attacks: (1) a trained classifier that infers semantic predicates about user memories (e.g., health conditions, financial events) from routine natural-language outputs, and (2) an RL-trained adversary that extracts full Social Security Numbers from a production-style agent.
Primary: University of California, San Diego
All Institutions: University of California, San Diego, University of Maryland
This paper presents a rigorous and impactful analysis of inadvertent context leakage in language models, demonstrating that sensitive information can be reconstructed from benign outputs through statistical side-channels, even when the model explicitly refuses to disclose it. The introduction of adaptive black-box decoders to exploit these channels provides a new and critical perspective on LLM privacy, with significant implications for the deployment of AI agents handling sensitive user data.
The paper introduces a novel threat model termed "inadvertent context leakage," moving beyond traditional direct extraction or prompt injection attacks. The core methodology involves training adaptive, black-box decoders (using LoRA-finetuned classifiers) to detect statistical correlations between in-context secrets and benign model outputs. The authors isolate specific leakage channels, including response length, stylistic features, and digit frequency profiles, demonstrating that these channels persist even when the model explicitly refuses to output the secret. The approach is rigorous, employing a controlled experimental setup across eight proprietary frontier models and utilizing both passive inference and active RL-optimized prompt injection to engineer covert channels.
The experimental evaluation is comprehensive and convincing. The authors test on eight leading proprietary models (Claude, Gemini, GPT, Grok) using a variety of secret lengths (1-8 digits) and semantic predicates. Key findings include near-perfect reconstruction of 2-digit secrets and 82% exact match for 4-digit secrets on Claude Opus 4.6. The paper provides strong ablation studies, including the "suppression" hypothesis (that stronger instructions to hide data paradoxically increase leakage by distorting the output distribution), cross-model transferability of decoders, and the effectiveness of the attack against production-style agents (SSN extraction). The results are statistically significant and robust across different prompt templates and context sizes.
The paper provides detailed descriptions of the attack pipelines, decoder architectures (Qwen-2.5-1.5B backbone with LoRA), and hyperparameters. The use of public APIs for proprietary models limits exact reproducibility of the victim models' internal states, but the attack methodology is clearly defined. The authors provide prompt templates and describe the GRPO optimization process for the active attack. The data collection process (1,000 secrets, 10 responses per pair) is well-documented, allowing other researchers to replicate the study on accessible models or verify the API interactions.
The study is limited to numeric secrets and binary semantic predicates; generalization to open-vocabulary, free-text secrets is not addressed due to the combinatorial explosion of the value space. The experiments are conducted in a black-box setting via APIs, which may not capture all side-channels available in local deployments. The "resistant" tier of models (Grok, GPT-nano) suggests that leakage is model-dependent, and the mechanisms for resistance are not fully understood or mitigated. The study assumes the adversary can query the model, which may not always be the case in all deployment scenarios.
This work has significant implications for the privacy of AI agents and the security of LLM deployments. It challenges the assumption that instruction-following and refusal mechanisms are sufficient for data protection. The findings suggest that privacy in LLMs requires fundamental architectural changes or information-theoretic guarantees rather than just prompt engineering or output filtering. This could drive new research into privacy-preserving model training, secure inference protocols, and standardized privacy benchmarks for AI agents. This paper presents a rigorous and impactful analysis of inadvertent context leakage in language models, demonstrating that sensitive information can be reconstructed from benign outputs through statistical side-channels, even when the model explicitly refuses to disclose it. The introduction of adaptive black-box decoders to exploit these channels provides a new and critical perspective on LLM privacy, with significant implications for the deployment of AI agents handling sensitive user data.
Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets. Yet whether these hidden CoTs can be directly extracted from black-box models remains largely unexplored. In this work, we systematically study whether hidden CoTs can be extracted near-verbatim from black-box LRMs through API interactions. We identify a previously overlooked reasoning replay surface between tool calls and develop EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals. We further develop an LLM-based optimization framework that automatically searches for an effective universal injection trajectory across various datasets. We evaluate EchoCoT on three open-source and five frontier proprietary LRMs. On open-source LRMs, EchoCoT achieves up to 66.4\% near-verbatim extraction success, with the extracted trace length within 10\% of the target and at least 90\% of tokens exactly matching the target CoT. The same injection trajectory also generalizes to unseen datasets, achieving up to 80\% extraction success under the same criterion. For tested frontier proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries. EchoCoT can also extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target. These results establish hidden-CoT extraction as a practical security risk and highlight the need to better protect hidden CoT assets.
Primary: CISPA Helmholtz Center for Information Security
All Institutions: CISPA Helmholtz Center for Information Security
EchoCoT establishes a practical and effective method for extracting hidden Chain-of-Thought traces from black-box Large Reasoning Models, exposing a significant security vulnerability in current API designs and setting a new benchmark for CoT privacy research.
The paper proposes EchoCoT, a sophisticated black-box attack that exploits the "reasoning replay surface" inherent in tool-calling mechanisms of Large Reasoning Models (LRMs). The core insight is that while standard multi-turn conversations discard hidden CoTs, tool calls preserve them within the context window. By iteratively injecting instructions via a scratchpad tool, the authors force the model to reproduce its hidden reasoning. The novelty lies in the automated optimization framework (LLM-based Inject-Reflect-Distill) that searches for universal injection trajectories using only API-provided proxy signals (token counts and summaries) as fidelity feedback. This is a clever adaptation of prompt optimization techniques to the specific constraints of black-box CoT extraction. The methodology is technically sound and demonstrates a deep understanding of LRM internal states and API behaviors.
The evaluation is extensive and rigorous. The authors test EchoCoT on three open-source LRMs (DeepSeek, Qwen, GLM) with ground-truth CoTs available for precise measurement, and five frontier proprietary models (Gemini, Claude) where they use proxy metrics and qualitative analysis. The results are striking: on open-source models, they achieve near-verbatim extraction (Token-EM > 0.90) for a significant fraction of samples. The cross-dataset transferability is also strong, with optimized trajectories working well on unseen datasets. The ability to extract very long CoTs (33k+ tokens) is a significant empirical finding. The baselines (Direct Prompting, CoT Synthesis, REP) are appropriate, and EchoCoT vastly outperforms them.
The paper provides a detailed description of the attack pipeline, optimization framework, and evaluation metrics. The code is available on GitHub. The use of public APIs for proprietary models ensures that the attack can be reproduced by others, provided they have access to the same models. The open-source model evaluations are fully reproducible.
The attack relies on the availability of tool-calling interfaces and specific API signals (reasoning token counts, summaries). Models that disable tool calls or hide these signals would be resistant. The attack is also computationally expensive due to the iterative nature and the need for multiple LLM calls for optimization. Furthermore, the success rate, while high, is not 100%, and failures often stem from length mismatches or refusals. The paper notes that defenses are possible but currently insufficient.
This work has profound implications for the security and privacy of frontier LRM providers. It demonstrates that hidden CoTs, considered valuable intellectual property and safety assets, are not secure against determined black-box attackers. This could lead to industrial espionage, leakage of sensitive training data, or bypassing of safety filters embedded in the reasoning process. It highlights a critical gap in the security design of LRM APIs and necessitates new defense mechanisms, such as obfuscating reasoning steps, limiting tool-call context, or detecting adversarial tool usage. EchoCoT establishes a practical and effective method for extracting hidden Chain-of-Thought traces from black-box Large Reasoning Models, exposing a significant security vulnerability in current API designs and setting a new benchmark for CoT privacy research.
Self-normalized concentration inequalities are standard tools in bandit and reinforcement-learning analyses. A widely used weighted extension claims an analogous time-uniform guarantee for discounted least-squares estimators in non-stationary problems. A simple scalar Gaussian counterexample with a fixed parameter shows that the claimed bounded radius is crossed with probability one. For fixed discount and regularization parameters, we further show that, when $δ\leq1/2$ and $T/δ$ is sufficiently large, any deterministic anytime boundary valid uniformly over the stated conditionally sub-Gaussian model class must be at least of order $R\sqrt{\log(T/δ)}$ at some time by horizon $T$; for nondecreasing boundaries, this order is required at time $T$. We identify the proof error: different terminal times use different Gaussian mixing distributions, so the fixed-time mixtures do not form one supermartingale, and the stopping-time argument does not repair this failure. Finally, we show that the weighted inequality remains valid at each fixed deterministic time, give valid finite- and infinite-horizon corrections, and discuss consequences for downstream analyses.
Primary: Academia Sinica
All Institutions: Academia Sinica, National Tsing Hua University
This paper provides a crucial correction to the theoretical analysis of discounted least-squares in non-stationary bandits, identifying a fundamental flaw in the proof of a widely used time-uniform concentration inequality and establishing the necessity of logarithmic confidence costs for valid anytime bounds.
The paper employs a rigorous theoretical analysis to identify a fundamental flaw in the proof of a widely used self-normalized concentration inequality for discounted least-squares estimators. The methodology involves constructing a scalar Gaussian counterexample to disprove the time-uniform bound claimed in prior work (RVC19weightedLB) and deriving matching lower bounds for any valid anytime boundary. The authors correctly identify the logical error in the original proof: the use of different Gaussian mixing distributions at different times prevents the construction of a single supermartingale required for Ville's inequality, and the proposed "stopping-time repair" is invalid because it conditions on a sequence of directions rather than a fixed one. This is a classic example of "e-hacking" or pseudo-maximization in sequential analysis. The correction provided involves explicit confidence allocation (union bound) which restores validity but at the cost of a logarithmic factor in the horizon.
As a theoretical note, the paper does not present empirical experiments in the traditional sense (e.g., training models on datasets). Instead, the "experiments" are the mathematical proofs of the counterexample and the lower bounds. The scalar Gaussian example serves as a synthetic proof-of-concept that the theoretical bounds fail. The evaluation is purely analytical, relying on probability theory and concentration inequalities.
The mathematical derivations, proofs, and counterexamples are fully detailed in the text and appendices. The logic is self-contained and reproducible by any researcher with a background in stochastic processes and bandit theory. The identification of the error in prior work is precise and verifiable.
The primary limitation is that this is a "negative" result paper; it identifies an error and provides a correction, but does not propose a new, more efficient algorithm or a significantly tighter bound than the corrected union-bound approach. The correction (union bound) is standard but may be loose in practice compared to what a correct time-uniform bound might achieve if one existed (though the lower bound suggests the logarithmic factor is necessary for non-decreasing boundaries). The scope is limited to the specific discounted least-squares setting and does not address all possible variations of non-stationary bandit algorithms.
This paper has significant impact on the theoretical foundations of non-stationary bandit and reinforcement learning literature. By correcting a widely cited inequality, it invalidates the theoretical guarantees of several downstream papers (RCG20-NSGLB, KT20, TV20, etc.) that relied on the flawed anytime bound. It forces the community to re-evaluate the regret bounds of these algorithms, potentially requiring them to pay an additional logarithmic factor or rely on fixed-time analysis with union bounds. It serves as an important cautionary tale regarding the application of Ville's inequality and supermartingale arguments in time-varying settings. This paper provides a crucial correction to the theoretical analysis of discounted least-squares in non-stationary bandits, identifying a fundamental flaw in the proof of a widely used time-uniform concentration inequality and establishing the necessity of logarithmic confidence costs for valid anytime bounds.
Most modern optimizers form their momentum as an exponential moving average (EMA) of past gradients, forgetting every direction at one fixed rate. However, the inputs a deep network sees during training can be highly anisotropic, with a few directions queried frequently while most are seen rarely. Recent methods address this anisotropy by wrapping extra processing around this buffer, leaving the momentum update itself unchanged. We propose DeltaMomentum, which builds direction-awareness into the momentum update rule. The main observation is that the gradient of a linear layer splits into an input that acts as a key and an output-side error that acts as a value. Exploiting the key-value structure, DeltaMomentum updates the momentum buffer by the canonical delta rule, so each direction is forgotten at a rate set by how often it appears. We prove that it is a valid momentum, that it applies the input-side curvature correction without matrix inversion, and that it clears stale directions faster than EMA under both a fixed and a drifting optimum. It is a drop-in replacement for the momentum buffer of any optimizer, its coefficient transfers across widths under $μ$P, and its extra compute stays between $22.2\%$ and $25.0\%$ of a gated-MLP block's linear cost with no persistent memory. In FineWeb-Edu pretraining, AdamW with DeltaMomentum (DeltaAdamW) reaches AdamW's validation loss in up to $46.39 \pm 4.32\%$ fewer steps at 67M and $22.12 \pm 0.80\%$ at 370M over three seeds, and the gain persists at 1B on a Chinchilla-optimal budget. A Muon baseline tuned under the same protocol sits above DeltaAdamW at both language-model scales, and the gain holds for SGD, ResNet-18, and ViT-Tiny on CIFAR-10. Training-time diagnostics confirm the predicted mechanism, better gradient tracking and healthier input directions.
Primary: University of Pennsylvania
All Institutions: University of Pennsylvania, Jane Street
DeltaMomentum introduces a theoretically grounded, direction-aware momentum update rule that leverages the key-value structure of gradients to achieve faster convergence and implicit preconditioning. The paper presents a compelling combination of rigorous theory, detailed mechanistic analysis, and strong empirical results across multiple scales and architectures, establishing a new baseline for momentum-based optimization that is likely to influence future optimizer design.
The paper proposes "DeltaMomentum," a novel momentum update rule that replaces the standard Exponential Moving Average (EMA) with a delta-rule update based on the key-value structure of rank-1 gradient factorization in linear layers. The core insight is that treating the momentum buffer as an associative memory allows for direction-aware forgetting rates, where directions queried frequently are updated more aggressively. The methodology includes a theoretical derivation showing that this update implicitly performs input-side preconditioning (similar to K-FAC but without matrix inversion) and provides guarantees on convergence and tracking of non-stationary targets. The approach is theoretically sound, well-motivated by the anisotropy of deep learning landscapes, and offers a clean, drop-in replacement for existing optimizers.
The experimental evaluation is comprehensive and convincing. The authors conduct controlled ablations against AdamW (the only baseline differing in the first moment) and Muon (a strong structured optimizer baseline) on Llama-2-style language models at 67M, 370M, and 1B parameters on FineWeb-Edu. The results show significant step-efficiency gains (up to 46% fewer steps) and competitive wall-clock efficiency. Additional experiments on CIFAR-10 with ResNet-18 and ViT-Tiny demonstrate generalizability. The inclusion of mechanistic diagnostics (gradient alignment, function-space prediction error, feature covariance conditioning) strongly supports the theoretical claims. The compute overhead is quantified and shown to be manageable.
The paper provides detailed algorithmic descriptions, theoretical proofs, and mentions specific implementation details (e.g., normalized keys, $\mu$P scaling). The experimental setup is described with sufficient detail for reproduction, including data sources (FineWeb-Edu) and model architectures. The authors provide a clear recipe for hyperparameter transfer, enhancing reproducibility.
The paper acknowledges limitations regarding scale (up to 1B parameters) and domain (language modeling only). It does not yet demonstrate performance on larger models (e.g., 7B+) or other domains like vision-only or multimodal tasks, though the CIFAR results suggest potential. The theoretical analysis relies on quasi-static approximations, which may not perfectly capture the highly non-stationary dynamics of deep training, although the empirical diagnostics support the theory.
This work has significant potential to improve the efficiency of training large-scale neural networks, reducing compute costs and energy consumption. By providing a drop-in replacement for momentum, it can be easily adopted by the community. The theoretical insights into the role of momentum as an associative memory could inspire further research into optimizer design. DeltaMomentum introduces a theoretically grounded, direction-aware momentum update rule that leverages the key-value structure of gradients to achieve faster convergence and implicit preconditioning. The paper presents a compelling combination of rigorous theory, detailed mechanistic analysis, and strong empirical results across multiple scales and architectures, establishing a new baseline for momentum-based optimization that is likely to influence future optimizer design.
Agent frameworks increasingly package procedural knowledge as skills: instruction files an agent reads on demand, while public libraries now hold thousands of them. Which skill to read has thus become a decision the policy itself makes in the middle of an episode, yet no existing signal trains it. We show that the default remedy, outcome-rewarded RL over the candidate slate, cannot teach it, for a structural reason we identify and name selector credit starvation: under a broadcast, sequence-level advantage, the few tokens that name the chosen skill carry a vanishing share of the loss, and the credit they inherit is increasingly wrong-signed as trajectories lengthen. A correct choice is punished whenever the execution after it fails, even though the choice itself is among the most valuable decisions in the trajectory. Auditing a completed run's own training artifacts confirms all three properties, each worsening monotonically with horizon. SkillGate removes the failure by construction: it partitions the token support into two disjoint credit channels, outcome credit reaching only execution tokens, and a separate action-local advantage reaching exactly the skill-naming tokens, positive only when a trajectory's single read is the correct one. On five agentic benchmarks under a 16-candidate slate, SkillGate lifts a 9B policy from 40.8% to 53.2% trial success, well ahead of the identical budget spent on outcome reward alone, while cutting exposure to misleading candidates by two thirds and reading fewer skills.
Primary: Unknown (Affiliations not explicitly listed in text, authors appear to be from various Chinese institutions based on names and "corrauth" markers)
All Institutions: Unknown
SkillGate introduces a novel disjoint credit channel architecture that solves "selector credit starvation," enabling 9B agents to reliably select skills from large slates, significantly outperforming outcome-only RL and demonstrating that selection is a trainable, distinct capability from execution.
The paper introduces "SkillGate," a method that addresses the specific problem of in-policy skill selection in long-horizon agentic tasks. The core technical contribution is the identification of "selector credit starvation," a structural flaw in standard outcome-rewarded RL where the tokens responsible for selecting a skill receive vanishingly small and often incorrectly signed gradients. The proposed solution partitions the token support into two disjoint credit channels: an execution channel using standard group-normalized outcome advantages, and a selection channel using an action-local advantage that rewards only the specific tokens naming the correct skill. This separation prevents the selection decision from being punished by execution failures and ensures the selection signal is not diluted by trajectory length. The methodology is theoretically sound, addressing a known bottleneck in agent training with a precise, mechanistic fix.
The authors evaluate SkillGate on five agentic benchmarks (Claw-Eval, SkillsBench, SETA, SWE, Terminal-Bench 2.0) using a 16-candidate slate. They demonstrate that SkillGate lifts a 9B policy from 40.8% to 53.2% trial success, outperforming outcome-only RL, supervised selection, and preference learning baselines. Crucially, they show that SkillGate achieves this with fewer reads and less exposure to misleading skills, indicating genuine improvement in selection capability rather than just increased tool usage. The ablation studies effectively isolate the contribution of the selection channel, showing that coarser credit assignment (group or trajectory level) fails to improve selection. The comparison with frontier models highlights that skill selection is a distinct capability not solved by scale alone.
The paper provides detailed implementation details, including the use of Qwen3.5-9B, GRPO, specific hyperparameters (learning rate, KL coefficient), and the structure of the training tasks. The description of the "standard mixed slate" and the construction of misleading candidates is clear. The audit methodology for demonstrating credit starvation is also well-described, allowing for replication of the diagnostic findings. However, the specific code for the "clean single-oracle utility" and the exact implementation of the disjoint credit masking would be necessary for full reproducibility, which is likely in a supplementary or code release not provided here.
The method requires that the correct skill is known during training to compute the selection advantage, limiting its applicability to settings with verifiable outcomes or oracle skills. The method assumes a "single read" constraint for the selection credit to be clean; reading multiple skills dilutes the signal. The evaluation is limited to 9B and 27B models, and while it outperforms larger frontier models in selection, it does not match their overall task success, suggesting that execution capability remains a bottleneck. The audit is performed on a single run's artifacts, and while the trends are clear, broader statistical significance across seeds is not explicitly detailed in the abstract/text provided.
This work has significant implications for the development of reliable autonomous agents. By solving the credit assignment problem for skill selection, it enables agents to effectively utilize large libraries of procedural knowledge, which is critical for complex, long-horizon tasks. The insight that selection and execution require disjoint credit channels is likely to influence future agent training methodologies, moving the field away from naive outcome-only RL for tool-use scenarios. It highlights the importance of fine-grained credit assignment in multi-decision trajectories. SkillGate introduces a novel disjoint credit channel architecture that solves "selector credit starvation," enabling 9B agents to reliably select skills from large slates, significantly outperforming outcome-only RL and demonstrating that selection is a trainable, distinct capability from execution.
Programmable logic controllers (PLCs) run industrial plants, and large language models can already generate independent program organization units (POUs) for them. Whether such logic integrates into an existing PLC project and then runs correctly has been checked only in limited tests. We present SemaPLC, a project-grounded and verification-gated agent harness assembled from conventional tools but governed by a strict completion rule. Rather than stopping when the model judges its own output adequate, SemaPLC declares a task complete only when logged external checks confirm it. Those checks cover the specification, the compilation, and the behavior on a live runtime. On 117 independent-POU tasks matching existing benchmarks, it attains the highest strict verified pass rate on all seven models (72.6\% mean). On a project-context track of 65 tasks whose generated logic must compile and run inside a real project, it attains the highest mean on integrated compilation, static behavior, and dynamic behavior. Of the three layers, dynamic behavior is the most revealing. We measure it by deploying the generated and the reference logic to a live PLC runtime and comparing their executed traces. All methods fall within 10 static points of one another, whereas dynamic scores separate them sharply, from 22.4 to 31.4 for the baselines against 52.2 for SemaPLC. Overall, our verification-gated harness raises the mean at every layer and most sharply at runtime. Execution, not static scoring, is the faithful test of whether generated control logic actually works. SemaPLC is open-sourced at https://github.com/midea-ai/SemaPLC.
Primary: Midea AI
All Institutions: Midea AI
SemaPLC presents a robust, verification-gated agentic framework for PLC code generation that significantly improves runtime reliability over static baselines, establishing a new standard for evaluation in industrial LLM applications.
The paper proposes SemaPLC, an agentic harness for generating Programmable Logic Controller (PLC) code in Structured Text (ST). The core methodological contribution is not a new neural architecture, but a rigorous "verification-gated" iteration loop. It combines project-grounded generation (retrieving context from existing PLC projects) with three layers of external verification: specification auditing, compilation, and live runtime validation. The agent is forced to repair code until these external checks pass, preventing premature termination based on self-assessment. This approach effectively treats the LLM as a component within a larger, tool-using agent system, leveraging the Model Context Protocol (MCP) for tool interaction. The methodology is sound and addresses a specific, high-stakes domain (industrial automation) where static code generation metrics are insufficient.
The evaluation is comprehensive and rigorous, which is the paper's strongest asset. It introduces two tracks: a function-level track (117 tasks) and a project-context track (65 tasks). The project-context track is particularly novel, requiring integration into existing industrial plant simulations. The authors evaluate across seven state-of-the-art LLMs. The results show that SemaPLC significantly outperforms baselines (LLM4PLC, AutoPLC, Agents4PLC) on dynamic runtime behavior, a metric that static analysis fails to capture. The ablation studies clearly demonstrate the value of each verification layer. The use of a live PLC runtime for evaluation provides a level of empirical truth often missing in LLM code generation papers. The audit of the previous benchmark (Agents4PLC) to fix defective properties adds credibility to the evaluation framework.
The paper provides a GitHub repository link. The methodology describes the tools and protocols (MCP) used. The evaluation setup, including the construction of scenarios and the handling of hidden references, is detailed. The open-sourcing of the harness and the cleaned benchmark data enhances reproducibility. The use of standard LLM APIs ensures that the backbone models are accessible, although the specific versions and endpoints are noted. The detailed description of the verification skills and the agent loop allows for reasonable replication of the system.
The paper acknowledges that dynamic scoring is limited to the bounded scenario set derived from the hidden reference, meaning generalization to unseen conditions is not fully measured. The advantage narrows on the strongest models (e.g., GPT-5.5), suggesting that as models improve, the marginal gain from the complex harness may decrease. The cost in terms of API requests is higher for SemaPLC on the project track compared to some baselines, which is a practical limitation for cost-sensitive applications. The focus on IEC 61131-3 ST limits immediate applicability to other PLC languages or industrial protocols without adaptation.
This work has significant implications for the deployment of LLMs in safety-critical industrial environments. By demonstrating that verification-gated agents can reliably generate code that works on live hardware, it provides a blueprint for trustworthy AI in automation. It highlights the gap between static code metrics and actual runtime performance, encouraging the field to adopt more rigorous, execution-based evaluation standards. The open-sourcing of the tool and benchmark contributes to the community's ability to build and evaluate agentic systems for industrial tasks. SemaPLC presents a robust, verification-gated agentic framework for PLC code generation that significantly improves runtime reliability over static baselines, establishing a new standard for evaluation in industrial LLM applications.
Estimating causal effects under network interference typically assumes that the network used for training and the network used for deployment coincide. In practice, an intervention is run on one population while the question of interest concerns a different population, and the two generally differ in topology, node-covariate composition, and spillover pathways. Transporting a causal effect across networks is therefore a data-fusion problem that no existing algorithm solves. We employ a selection diagram, extended to the network setting so that covariate shift and structural network shift enter as separate selectors, and derive from it a transport formula for the direct, spillover, and total effects in the deployment population. Each formula makes explicit which interventional mechanism is assumed invariant and which observational distribution must be reweighted. We then turn the formulas into TranCE (Transported Causal Effects), a doubly-robust algorithm combining an interventional outcome model, a domain density-ratio correction, and cross-fitted inference. Extensive experiments on two semi-synthetic benchmarks derived from real-world social networks and on a fully real weather-insurance field experiment, where the transported effects are checked against held-out randomized estimates, confirm the effectiveness of our approach. Our findings have the potential to improve intervention strategies in networked systems, particularly in social networks and public health.
Primary: Unknown
All Institutions: Unknown
TranCE provides a theoretically grounded and empirically validated solution for transporting causal effects across networks under interference, addressing a critical limitation of existing methods that assume identical network structures. The extension of selection diagrams to network settings and the doubly-robust estimator offer a significant advancement in the field of causal machine learning.
The paper addresses a significant gap in causal inference: transporting causal effects across different network topologies and covariate distributions under interference. The core theoretical contribution is the extension of selection diagrams to the network setting, explicitly separating covariate shift ($S_Z$) from structural network shift ($S_G$). This allows for the derivation of transport formulas for direct, spillover, and total effects. The proposed algorithm, TranCE, implements these formulas using a doubly-robust estimator that combines an interventional outcome model (using GCNs to handle network structure) with a domain density-ratio correction (using logistic regression) and cross-fitted inference. The methodology is rigorous, leveraging standard causal inference tools (do-calculus, doubly-robust estimation) in a novel, complex setting. The separation of structural and covariate shifts is a key theoretical insight that clarifies what assumptions are required for transportability in networked systems.
The evaluation is extensive and convincing. It includes two semi-synthetic benchmarks (Twitch, Facebook-100) with rotating source-target pairs to simulate cross-network transport, and a fully real-world field experiment (weather-insurance in rural China). The semi-synthetic experiments compare TranCE against strong baselines including TARNet, IPW, IGL, Hoshino, NetEst, DANN, and IW-GCN. TranCE consistently achieves the lowest bias, particularly for spillover effects, demonstrating the necessity of both the outcome model and the density-ratio correction. The ablation studies effectively isolate the contributions of different components. The real-world validation against held-out randomized estimates provides strong external validity. The analysis of "Where Transport Is Hard" (correlation between structural gap and bias) is particularly insightful for practitioners.
The paper states that source code, data-preparation scripts, and instructions are included in a supplement. The mathematical derivations are detailed, and the algorithmic steps are clearly described. The use of standard libraries (PyTorch, GCNs) and well-defined causal estimators aids reproducibility. The semi-synthetic data generation process is described, though the specific parameters might require careful reading of the appendix. The real-world dataset (Cai insurance) is publicly available.
The method relies on the assumption of stratified interference, which limits the scope of interference to local neighborhoods. The neighbor treatment summary is discretized into a small number of levels, which might lose information. The method assumes that the interventional mechanism is invariant across domains (except for the parts captured by the selectors), which is a strong assumption in practice. The performance degrades significantly when there is a large structural gap between source and target networks, although this is expected and well-documented. The method also assumes overlap in the covariate space, which can be difficult to verify and ensure in high-dimensional settings.
This work has significant potential impact for policy evaluation in social networks, public health interventions, and online platform optimization. By enabling the transport of causal effects from controlled experiments to observational settings with different network structures, it allows for more efficient and ethical deployment of interventions. It provides a rigorous framework for understanding the limits of generalizability in networked causal inference. TranCE provides a theoretically grounded and empirically validated solution for transporting causal effects across networks under interference, addressing a critical limitation of existing methods that assume identical network structures. The extension of selection diagrams to network settings and the doubly-robust estimator offer a significant advancement in the field of causal machine learning.
Coupled-cluster theory defines the accuracy standard for molecular electronic-structure properties but scales too steeply for routine application, whereas density-functional theory is affordable yet systematically biased. We resolve this trade-off with a single equivariant network, MEHnet-MG, that predicts an effective one-electron Hamiltonian from one inexpensive B3LYP/def2-SVP calculation and derives a broad suite of properties from it (energy, optical gap, dipole, quadrupole, polarizability, Mulliken atomic charges, and Mayer bond orders) at coupled-cluster accuracy across nine main-group elements, including the under-served phosphorus, sulfur, and chlorine chemistries. The model is trained on a new in-house dataset of multi-property labels computed at the CCSD(T) level for all nine elements. On a held-out test set, it reduces the error of every property by a factor of 3.8 to 230 relative to semi-local, hybrid, and double-hybrid DFT (referenced to composite CCSD(T)/cc-pVTZ; Methods), while adding only ~25 ms wall time per molecule, delivering coupled-cluster-quality predictions at the cost of a single DFT calculation. Critically, deriving every property from a predicted Hamiltonian rather than pooling per-atom features builds the correct size-scaling into the model architecture: on pi-conjugated oligothiophenes it matches finite-field CCSD polarizability and the EOM-CCSD optical gap to ~2% at the largest sizes where those references remain affordable (44 and 37 atoms, where a single CCSD field point already costs ~500x the model's entire inference) and extrapolates the corrected trends to 58-atom chains, a regime where pooling-based architectures fail by construction. Accurate extrapolation is therefore set by the model's inductive bias rather than by the training data.
Primary: Massachusetts Institute of Technology
All Institutions: Massachusetts Institute of Technology, Honda Research Institute, U.S. Department of Energy, National Energy Research Scientific Computing Center, Texas Advanced Computing Center
This paper presents a significant advance in scientific machine learning by introducing a Hamiltonian-readout equivariant network that achieves coupled-cluster accuracy for multiple molecular properties at DFT cost, with demonstrated ability to extrapolate size-scaling trends beyond the training distribution.
The paper introduces MEHnet-MG, a novel equivariant graph neural network architecture that predicts an effective one-electron Hamiltonian correction to a cheap DFT baseline (B3LYP/def2-SVP). The core methodological innovation is the "Hamiltonian read-out" strategy: instead of pooling atomic features to predict properties directly (which enforces strict extensive/intensive scaling), the model predicts local corrections to the Fock matrix and screening matrix. Properties are then derived via exact quantum-mechanical operators (diagonalization, linear response). This architectural choice embeds the correct physical size-scaling into the model, allowing it to extrapolate to larger systems where pooling-based models fail. The approach effectively decouples the accuracy ceiling (set by the CCSD(T) labels) from the computational cost (set by the DFT baseline).
The evaluation is rigorous and comprehensive. The authors train on a new in-house dataset of ~42k main-group molecules and test on a held-out set of 959 molecules. They benchmark against three standard DFT functionals (BP86, B3LYP, DSD-PBEP86) and demonstrate significant error reductions (factors of 3.8 to 230) across seven properties (energy, gap, dipole, quadrupole, polarizability, charges, bond orders). Crucially, they perform out-of-distribution tests on oligothiophene chains up to 58 atoms, showing that MEHnet-MG correctly extrapolates super-linear scaling of polarizability and gap saturation, whereas ablated pooling-based models diverge. They also validate against experimental dipole moments from NIST CCCBDB, showing accuracy comparable to canonical CCSD(T).
The paper provides extensive details on the dataset generation, filtering, and reference calculations. Code, model weights, and data generation scripts are made publicly available on GitHub. The authors explicitly discuss the limitations of their train/test split (index-based rather than scaffold-based) and provide a roadmap for future benchmarks. The reproducibility is high, although the full training dataset labels are not publicly redistributed, requiring regeneration or request.
The primary limitation is the reliance on the quality of the training labels. The optical gap predictions are bounded by the EOM-CCSD/cc-pVDZ reference, which lacks diffuse functions and thus has a known offset from experiment. The model inherits this error. Additionally, the method is currently limited to closed-shell, neutral main-group molecules (H, C, N, O, F, Si, P, S, Cl). The train/test split is not scaffold-split, so true chemical generalization to unseen scaffolds is not fully validated. The cost is dominated by the DFT baseline, not the neural network, so hardware acceleration of the DFT step is still required for high throughput.
This work represents a significant step toward bridging the accuracy-cost gap in computational chemistry. By enabling coupled-cluster accuracy at DFT cost for a broad suite of properties across the main group, it facilitates high-throughput screening of materials and molecules that were previously inaccessible to high-accuracy methods. The architectural insight regarding Hamiltonian read-outs for size-transferability is likely to influence the design of future scientific machine learning models. This paper presents a significant advance in scientific machine learning by introducing a Hamiltonian-readout equivariant network that achieves coupled-cluster accuracy for multiple molecular properties at DFT cost, with demonstrated ability to extrapolate size-scaling trends beyond the training distribution.
OWL 2 DL ontologies, grounded in the description logic $\mathcal{SROIQ}$, express large knowledge bases in biomedicine and the Semantic Web. Neuro-symbolic (NeSy) learners over description logics either embed the ontology in a continuous space, abandoning classical entailment, or restrict to the Horn fragment $\mathcal{EL}^{++}$, which has a single canonical model. We present Baobab, which compiles a $\mathcal{SROIQ}$ ontology with a finite ABox into a Sentential Decision Diagram (SDD): it saturates a propositional core under a consequence-based calculus and instantiates the remaining $\mathcal{SROIQ}$ features (nominals, number restrictions, and the role axioms) over the active domain. The SDD's evidence-conditioned weighted model count then trains a perception network to recognize real images under partial ABox supervision: on an ontology that exercises every distinctive $\mathcal{SROIQ}$ feature, a CNN learns to read MNIST digits coupled by a successor relation and recovers latent ontology concepts that an independent perception leaves at chance. When the supervision admits several ontology-consistent completions, an independent perception collapses onto one, a reasoning shortcut: we show that a mixture indexed by the query's justifications can represent the calibrated posterior no independent perception can, and that seeding it from the circuit's enumerated completions attains the Bayes-optimal posterior on a real-image MNIST task where single-WMC and learned mixtures (the BEARS-ensemble hypothesis class) do not: to our knowledge the first to characterize and mitigate reasoning shortcuts in a non-Horn description logic. Soundness of the compiler and the representation result are machine-checked in Lean 4. Code is available at https://github.com/bio-ontology-research-group/baobab.
Primary: King Abdullah University of Science and Technology
All Institutions: King Abdullah University of Science and Technology
Baobab introduces a rigorous, formally verified compiler from OWL 2 DL to differentiable SDDs, solving the critical problem of multi-modal reasoning shortcuts in neuro-symbolic learning and enabling exact logical training on expressive ontologies.
The paper presents "Baobab," a novel neuro-symbolic framework that bridges the gap between expressive Description Logics (specifically OWL 2 DL / $\mathcal{SROIQ}$) and differentiable neural learning. The core methodological innovation is a consequence-based compiler that transforms an $\mathcal{SROIQ}$ ontology and a finite ABox into a Sentential Decision Diagram (SDD). This allows for exact, differentiable weighted model counting (WMC) over the logical constraints during the training of a perception network (CNN). Crucially, the authors address the "reasoning shortcut" problem inherent in single-mode WMC losses when supervision is partial or ambiguous. They propose "JustWMC," a mixture-of-experts approach where mixture components are seeded from the logical justifications (completions) enumerated by the circuit. This allows the model to represent multi-modal posteriors that a standard independent perception cannot. The formalization is rigorous, with soundness proofs for the compiler and representation results for the mixture model, all machine-checked in Lean 4.
The experimental evaluation is strong and well-designed. The authors use two primary benchmarks: a synthetic MNIST-based task involving successor relations and parity/primality constraints, and a real-world application using the Pizzaiolo ontology with ResNet encoders. The MNIST experiments effectively isolate the logical reasoning capabilities, demonstrating that Baobab recovers latent concepts (digit identities) with high accuracy ($0.99$) under fully determined supervision and significantly outperforms baselines (single-WMC, BEARS) in under-determined regimes by correctly modeling multi-modal posteriors. The Pizzaiolo experiment validates the approach on a real, complex ontology. The results are statistically significant (Holm-corrected). The comparison against BEARS is particularly compelling, showing that JustWMC attains the Bayes-optimal posterior where learned mixtures fail.
The paper provides a clear algorithmic description, including normalization, saturation, grounding, and SDD compilation steps. The code is explicitly made available at the provided GitHub URL. The use of standard libraries (PySDD, PyTorch) and the availability of the Lean 4 formalization add to the reproducibility and trustworthiness of the claims. The experimental setup details (seeds, metrics, hyperparameters) are sufficiently described.
The primary limitation is the computational complexity of compiling $\mathcal{SROIQ}$ ontologies to SDDs. While the paper claims polynomial bounds in certain contexts, SDD size can still be exponential in the treewidth of the underlying constraint graph. The "grounding" step over the active domain may become prohibitive for very large ABoxes, although the paper notes this is a known trade-off for exact reasoning. Additionally, the current evaluation focuses on image data; generalization to other modalities (text, graph) is not demonstrated, though the method is modality-agnostic in principle. The reliance on finite ABoxes for grounding is a standard assumption in this subfield but limits direct application to infinite domains without approximation.
This work significantly advances the field of Neuro-Symbolic AI by enabling the use of highly expressive, standard-compliant ontologies (OWL 2 DL) in differentiable learning pipelines. This has immediate implications for biomedical informatics, scientific knowledge discovery, and the Semantic Web, where logical consistency is paramount. By providing a mechanism to handle multi-modal logical uncertainty (reasoning shortcuts), it offers a more robust foundation for AI systems that must reason under ambiguity. The formal verification in Lean 4 sets a high bar for reliability in NeSy systems. Baobab introduces a rigorous, formally verified compiler from OWL 2 DL to differentiable SDDs, solving the critical problem of multi-modal reasoning shortcuts in neuro-symbolic learning and enabling exact logical training on expressive ontologies.
Most large language model services use stateless defenses, which judge only the current request, to refuse harmful tasks. Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers. Defending against them therefore requires a stateful monitor that considers requests together. If it can group all requests for one attacker task, it can stop the attack. However, attackers can use unlinkable identities and combine answers elsewhere, leaving no reliable grouping signal. We ask whether decomposition attacks can still be stopped under this setting. For a fixed attack strategy without retries, we prove that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped. Persistent, recognizable groups permit a useful defense; fresh, indistinguishable groups do not. When attackers can retry and learn from Allow/Block decisions, this useful operating point disappears: the feedback reveals what passes but not whether a block was correct. Experiments on 91 executable tasks and 11,393 capability-matched benign requests support these results. Under a 1% denial cap for these requests and a 0.5% cap for unrelated background traffic, all ten tested policies, including one privileged policy with an exact request-to-operation map, either fail to stop attacks or exceed the budget. On defense-unseen task families, attack success is at least 99% after one attempt and 100% after two. Effective defenses therefore require additional evidence or mechanisms tied to grouping, such as reliable identity linkage, costs for fresh identities, or control over answer use.
Primary: Johns Hopkins University
All Institutions: Johns Hopkins University
This paper provides a rigorous theoretical and empirical demonstration of the fundamental limits of stateful defenses against decomposition attacks in LLM services when attacker identities are unlinkable, establishing a critical benchmark for future safety research.
The paper presents a rigorous theoretical and empirical analysis of "decomposition attacks" against Large Language Model (LLM) services. The core methodological contribution is the formalization of the security-utility tradeoff in stateful defense systems where attacker identities are unlinkable. The authors derive a theoretical bound showing that without reliable grouping signals (identity linkage), effective defense is impossible under specific constraints. They complement this with extensive experiments testing ten different defense policies against executable tasks, demonstrating that current state-of-the-art defenses fail to stop attacks when identities are unlinkable and feedback is limited. The approach combines game-theoretic reasoning with practical red-teaming, providing a robust framework for understanding the limits of current LLM safety mechanisms.
The experimental evaluation is comprehensive and convincing. The authors test against 91 executable tasks and over 11,000 capability-matched benign requests. The results are stark: under strict denial caps (1% for target, 0.5% for background), all tested policies either failed to stop attacks or exceeded the budget. On defense-unseen task families, attack success rates were 99% after one attempt and 100% after two. The use of executable tasks adds a layer of practical relevance compared to purely text-based benchmarks. The control of benign request matching ensures that the observed failures are not due to poor utility but rather fundamental structural limitations of the defenses.
The paper provides a clear formulation of the attack and defense models. The dataset of 91 executable tasks and the description of the 11,393 benign requests allow for replication. The theoretical proofs are included in the supplement. The experimental setup is described in sufficient detail for other researchers to reproduce the failure modes of the tested policies.
The primary limitation is the assumption of "unlinkable identities." While realistic for many public-facing APIs, it may not hold for authenticated enterprise services where identity is known. Additionally, the theoretical results are specific to the defined threat model (fixed strategy without retries, or retry with limited feedback). The paper does not explore defenses that rely on external signals (e.g., IP reputation, device fingerprinting) as primary grouping mechanisms, though it mentions them as necessary. The scope is limited to decomposition attacks; other attack vectors are not the focus.
This paper has significant implications for the deployment of LLM services. It challenges the industry's reliance on stateless or weakly stateful defenses and highlights a critical vulnerability in the current paradigm of LLM safety. The findings suggest that effective defense requires either reliable identity linkage (which raises privacy concerns) or new architectural approaches to content moderation. This work will likely influence the development of more robust safety standards and the design of future LLM APIs, pushing the field towards more holistic security models that account for multi-turn, multi-account adversarial behavior. This paper provides a rigorous theoretical and empirical demonstration of the fundamental limits of stateful defenses against decomposition attacks in LLM services when attacker identities are unlinkable, establishing a critical benchmark for future safety research.
Browser agents perform well on short, clean demonstrations, but real deployment is fundamentally different: agents must sustain dozens of decisions on live websites while recovering from mistakes and navigating complex UIs. We argue that closing this gap requires alignment at every level of the pipeline, including execution, supervision, optimization, and evaluation, rather than scale alone. We present Wuying-Browser-Agent, a unified framework that addresses each of these levels. A structured browser harness provides stable execution primitives and decision-oriented context management. Reflection and UI-specialized Curriculum SFT (RUIC-SFT) explicitly trains on recovery trajectories and complex-UI interactions. Divergence-Aware Online GRPO (DAO-GRPO) improves long-horizon credit assignment through potential-based reward shaping and divergence-aware step weighting. Finally, we introduce BrowserBench, a bilingual real-web benchmark of 350 tasks averaging 37.9 steps, because most existing benchmarks are too short to expose long-horizon failure modes. Wuying-Browser-Agent-27B achieves 80.6\% on WebVoyager, 66.7\% on Online-Mind2Web, and 65.1\% on BrowserBench, establishing a new open-source state of the art on browser-use benchmarks. The same pipeline also transfers beyond browser use, demonstrating strong general agentic ability and reaching an average score of 73.8 on Tau2-Bench, Claw-Eval, and BFCL-v4.
Primary: Alibaba Cloud
All Institutions: Alibaba Cloud
Wuying-Browser-Agent presents a comprehensive and practically significant framework for long-horizon browser agents, combining structured execution, recovery-oriented supervised fine-tuning, and divergence-aware reinforcement learning to achieve state-of-the-art results on challenging real-world benchmarks.
The paper proposes a unified framework for long-horizon browser agents, addressing three specific structural challenges: lack of recovery supervision, dilute credit assignment in long trajectories, and insufficient bilingual evaluation. The methodology consists of three main components: (1) a structured browser harness for stable execution and context management; (2) RUIC-SFT, a curriculum-based supervised fine-tuning stage that incorporates reflection-rich recovery trajectories and specialized UI interaction data; and (3) DAO-GRPO, an online reinforcement learning algorithm that uses potential-based reward shaping and divergence-aware step weighting to improve long-horizon credit assignment. The approach is technically sound and addresses real pain points in the field of agentic LLMs. The integration of recovery data into SFT and the specific design of the divergence-aware GRPO variant are notable contributions. However, the core ideas (curriculum learning, reward shaping, divergence analysis) are incremental extensions of existing techniques rather than fundamentally new theoretical breakthroughs.
The authors evaluate Wuying-Browser-Agent on WebVoyager, Online-Mind2Web, and their own benchmark, BrowserBench. The model achieves state-of-the-art results among open-source models on these benchmarks. The introduction of BrowserBench is a significant contribution, providing a more realistic, long-horizon, and bilingual evaluation suite. The experiments demonstrate that RUIC-SFT and DAO-GRPO provide consistent gains, particularly on longer and more complex tasks. The transferability to general agentic benchmarks (Tau2-Bench, Claw-Eval, BFCL-v4) is also demonstrated, suggesting the method improves general tool-use capabilities. The evaluation is comprehensive and convincing, although the reliance on a new benchmark requires the community to adopt it for future comparisons.
The paper provides detailed descriptions of the browser harness, data construction processes, and training objectives. The structured action space and context management rules are well-defined. The authors mention releasing the model at 4B, 9B, and 27B scales, which aids reproducibility. However, the specific hyperparameters for the divergence-aware step weighting and the exact details of the LLM-based divergence estimator are somewhat abstractly described ("tuned on the validation set"), which might make exact replication challenging without access to the code or further details. The use of a proprietary sandbox (AgentBay) for evaluation also introduces some dependency, although the interface is described as lightweight and protocol-based.
The paper acknowledges that the divergence estimator is an LLM-based heuristic and not an exact oracle. The method relies on a curated set of reflection and UI-specialized data, which may not cover all possible failure modes or UI types. The performance on BrowserBench, while strong, is specific to the tasks included, and generalization to entirely new domains or website structures is not fully explored. The computational cost of online RL with grouped rollouts and divergence analysis is likely high, which may limit accessibility for smaller research groups. Additionally, the "divergence-aware" mechanism's reliance on an external LLM for step comparison adds latency and complexity to the training loop.
This work contributes to the development of more robust and reliable autonomous agents for web interaction, which has significant implications for automation, accessibility, and human-computer interaction. The introduction of BrowserBench encourages the community to focus on long-horizon, real-world, and bilingual tasks, moving beyond short, synthetic, or English-only benchmarks. The open-sourcing of the models and potentially the benchmark (if included in the release) will facilitate further research in agentic AI. However, the increased capability of browser agents also raises concerns about automated scraping, botting, and security vulnerabilities on the web, which should be considered in the deployment of such systems. Wuying-Browser-Agent presents a comprehensive and practically significant framework for long-horizon browser agents, combining structured execution, recovery-oriented supervised fine-tuning, and divergence-aware reinforcement learning to achieve state-of-the-art results on challenging real-world benchmarks.
Reliable optimization is central to neural network (NN) training, yet Adam, the default optimizer for modern LLMs, rests on a fragile foundation. This thesis develops a principled grounding for Adam and motivates new designs. First, we revisit Adam's divergence--convergence debate and show the existence of a problem-dependent phase transition: with properly chosen, batch-size-dependent hyperparameters, Adam converges, whereas under small-$β_2$ regimes it can diverge. Second, we investigate why Adam substantially outperforms SGD on Transformers through Hessian structure. We find that the Hessian evolves toward a near-block-diagonal form along training, accompanied by strong block heterogeneity. We prove that this structure makes Adam's diagonal preconditioner effective. We further show that this special Hessian structure originates from consecutive multiplications of large matrix variables, and we provide a rigorous analysis based on random matrix theory. Finally, these insights motivate Adam-mini, a new optimizer that reduces Adam's memory footprint by 50\% while preserving its performance. Our results also have broader implications beyond Adam: they reveal new local structures in matrix-based nonconvex problems, and also help understand and improve recent NN optimizers, such as Muon.
Primary: The Chinese University of Hong Kong, Shenzhen
All Institutions: The Chinese University of Hong Kong, Shenzhen
This paper provides a comprehensive theoretical and empirical analysis of the Adam optimizer, resolving the divergence-convergence debate through a problem-dependent phase transition analysis and explaining Adam's superiority on Transformers via a novel Random Matrix Theory-based characterization of Hessian block structure.
The paper presents a rigorous theoretical analysis of the Adam optimizer, addressing two major gaps in existing literature: (1) the divergence-convergence debate initiated by Reddi et al. (2019), and (2) the empirical superiority of Adam over SGD on Transformer architectures. Methodologically, the authors establish a "problem-dependent phase transition" for Adam, proving that convergence is guaranteed if hyperparameters ($\beta_1, \beta_2$) are chosen dependent on the batch size (specifically, $\beta_2$ must be sufficiently large relative to the number of mini-batches $n$). This reconciles the theoretical divergence results with practical success. Furthermore, the paper introduces a novel theoretical framework using Random Matrix Theory (RMT) to analyze the Hessian structure of Neural Networks. It proves that Hessians in Transformers and MLPs evolve toward a near-block-diagonal form with strong block heterogeneity. This structural insight explains why Adam's diagonal preconditioning is effective (it handles block heterogeneity) while SGD fails (it uses a uniform learning rate). The paper also proposes "Adam-mini," an optimizer variant that reduces memory footprint by 50% by exploiting these structural insights. The theoretical tools developed, particularly the decoupling method for dependent random matrices in RMT, appear to be of independent mathematical interest.
The experimental evaluation supports the theoretical claims. The authors provide extensive sweeps of hyperparameters on MNIST and CIFAR-10 to validate the divergence-convergence phase transition, showing that Adam fails in the predicted "danger region" and succeeds in the "safe region." They also empirically demonstrate the block-diagonal structure of Hessians in Transformers and the resulting performance gap between Adam and SGD. The "Adam-mini" optimizer is shown to match Adam's performance with half the memory. While the experiments are convincing, they are largely synthetic or on standard benchmarks, lacking large-scale LLM pre-training results for the new optimizer, which is a limitation given the paper's focus on LLMs.
The paper is a summary of a PhD thesis, which typically contains comprehensive proofs and code. The arXiv version omits proofs due to page limits but cites the full thesis and associated conference papers (NeurIPS 2022, ICLR 2025). The theoretical conditions are clearly stated, and the empirical results (hyperparameter sweeps) are reproducible. The "Adam-mini" code is likely available via the cited ICLR 2025 paper.
As a thesis summary, the full technical depth (proofs) is omitted. The theoretical bounds for $\beta_2$ are described as "not tight," and the optimal $\beta_2$ within the convergence range is left as an open question. The analysis of CNNs is acknowledged as incomplete due to computational constraints. The "Adam-mini" optimizer's performance is demonstrated on smaller scales; its efficacy at the scale of modern LLMs (trillions of parameters) is implied but not fully validated in this specific text.
This work has significant implications for the field of deep learning optimization. By providing a rigorous theoretical grounding for Adam's success and failure modes, it helps demystify one of the most widely used algorithms. The insights into Hessian structure provide a new lens for understanding why certain optimizers work better for certain architectures (e.g., Transformers vs. CNNs). The proposed Adam-mini offers a practical benefit for memory-constrained training. The RMT techniques developed may find application in other areas of statistical physics and high-dimensional statistics. This paper provides a comprehensive theoretical and empirical analysis of the Adam optimizer, resolving the divergence-convergence debate through a problem-dependent phase transition analysis and explaining Adam's superiority on Transformers via a novel Random Matrix Theory-based characterization of Hessian block structure.
Neural autoregressive models have rapidly emerged as powerful emulators of high-dimensional chaotic systems, yet their long-term instability and error growth remain poorly understood, leading to ad-hoc solutions. Here, we develop an eigenanalysis framework that reveals the dynamical origin of this error growth. By analyzing the Jacobian of the learned one-step update map with respect to the state, we show how inference-time error growth, and thus model stability, is governed by its spectral radius. Direct-step architectures (models that predict the next state from the previous one) generically admit unstable eigenvalues with magnitudes exceeding one, explaining the rapid divergence of these widely used models. In contrast, integration-constrained models (where the time derivative is estimated and integrated with a higher-order integrator) collapse their eigenspectrum onto the unit circle, yielding neutral stability and a universal linear error-scaling law. The largest eigenvalue of this Jacobian provides an architecture-agnostic, a priori diagnostic of short-term skill, long-term stability, and spectral bias, without requiring an expensive rollout. Leveraging this theory, we introduce a stability-promoting loss that explicitly regularizes Jacobian-driven error amplification, improving both forecast accuracy and dynamical robustness. Demonstrated across $29$ models spanning two architectures, several explicit and implicit integrators, and multiple loss functions on the Kuramoto-Sivashinsky system, our results establish a theoretical foundation for the design and evaluation of neural emulators of chaotic multi-scale dynamics. More broadly, our framework is a step toward the kind of a priori stability analysis that numerical analysis provides for discretizations of differential equations and that scientific machine learning currently lacks.
Primary: University of California, Santa Cruz
All Institutions: University of California, Santa Cruz, National Science Foundation, DARPA, Sloan Foundation, Schmidt Sciences, LLC, National Center for Atmospheric Research
The paper establishes a rigorous eigenanalysis framework for neural autoregressive emulators of chaotic dynamics, revealing that integration constraints ensure neutral stability by clustering Jacobian eigenvalues near unity, and introduces a stability-promoting loss that improves long-term forecast accuracy.
The paper proposes a rigorous eigenanalysis framework for understanding the stability of neural autoregressive emulators of chaotic systems. By analyzing the Jacobian of the learned one-step update map with respect to the state (not parameters), the authors derive a linear stability theory that distinguishes between direct-step and integration-constrained architectures. They demonstrate that integration constraints force the Jacobian's spectral radius to cluster near unity, leading to neutral stability and linear error growth, whereas direct-step models exhibit unstable eigenvalues leading to exponential error growth. The methodology includes a novel stability-promoting loss function that regularizes this Jacobian-driven amplification. The theoretical derivation is sound, connecting concepts from numerical analysis (linear stability, integrators) with deep learning (Jacobian spectra, spectral bias).
The evaluation is extensive and systematic, testing 29 models across two architectures (MLP, FNO), multiple integration schemes (Euler, RK4, PEC4, Implicit Euler), and various loss functions on the Kuramoto-Sivashinsky system. The experiments robustly validate the theoretical predictions: direct-step models diverge rapidly, while integration-constrained models show linear error scaling consistent with the derived law. The introduction of the stability-promoting loss is empirically shown to reduce the error growth exponent, confirming the practical utility of the theoretical insights. The use of a canonical, well-understood chaotic system allows for precise verification against known dynamical properties (Lyapunov exponents, linear operator symbols).
The paper provides a GitHub repository link for the computational codes. The experimental setup is described in detail, including the KS system parameters, domain length, and training protocols. The clear distinction between the state-Jacobian and parameter-Jacobian, along with the explicit formulas for the integration-constrained Jacobians, enhances reproducibility. The systematic sweep of 29 models provides a strong baseline for future comparative studies.
The primary limitation is the scope of the experimental validation, which is confined to the Kuramoto-Sivashinsky equation. While KS is a canonical model for multi-scale chaos, it is lower-dimensional and simpler than full Earth system models (e.g., atmospheric dynamics). The theoretical analysis is local (linearized around the true trajectory at the initial condition), and the scaling law holds only for short-to-medium rollouts where the small-error approximation is valid. The paper acknowledges the need for nonlinear extensions and testing on higher-dimensional systems. Additionally, the "a priori" diagnostic requires computing the Jacobian at inference time, which may be computationally expensive for very high-dimensional state spaces, although the authors suggest trace estimation techniques.
This work addresses a critical bottleneck in scientific machine learning: the long-term instability of neural emulators. By providing a theoretical foundation for stability analysis akin to classical numerical analysis, it offers a principled path for designing more robust and reliable models for climate, weather, and other chaotic systems. The stability-promoting loss function is a generalizable tool that can be applied to various architectures and systems. The framework shifts the field from ad-hoc stabilization heuristics to theory-driven design, potentially accelerating the adoption of neural emulators in high-stakes scientific applications. The paper establishes a rigorous eigenanalysis framework for neural autoregressive emulators of chaotic dynamics, revealing that integration constraints ensure neutral stability by clustering Jacobian eigenvalues near unity, and introduces a stability-promoting loss that improves long-term forecast accuracy.
Retrieval-augmented generation (RAG) answers a question by retrieving passages from a vector store and trusting them as context, so anyone who can add documents can try to steer the answer. A recent, appealing defense filters poisoning at ingestion, rejecting any document that behaves like a hub. We show it -- and every ingestion-time filter -- is defeated by a coordinated adversary that injects a handful of individually unremarkable documents which together surround one target query and seize its top-k (on BGE-large / BEIR, m=10 documents take 10/10; 9.9/10 on a live HNSW index). The attack is not theoretical. Realized as ordinary fluent text and run end-to-end through a BGE-large + HNSW + Qwen2.5-7B pipeline, it makes the generator emit the attacker's planted claim in 88% of targets, versus 0% without the injection. And no admission-time defense stops it: at ingestion an attack cone is geometrically identical to a legitimate niche upload, so -- measuring this directly -- the strongest trained classifier, given every feature and thousands of examples, separates the two no better than chance, catching 4.2% of attacks at a 1% false-positive rate. We prove this limit for the entire class of ingestion-time statistics (any decision from documents and reference queries alone), and it reproduces -- and worsens -- across two corpora and five encoders. The one signal that separates an attack from legitimate niche ingestion -- a query's demand -- is invisible before retrieval, which is also the escape: a retrieval-time detector that observes demand catches 100% of the attacks at the same 1% false-positive rate. Coverage of the query space by an admission gate is not containment of coordinated poisoning; robust defense must move past the front door, to demand.
Primary: Santa Clara University
All Institutions: Santa Clara University, Colonia (likely typo for a university or institution in Colonia, NJ, but text says "Colonia, NJ, USA")
This paper makes a significant contribution to the field of AI security by rigorously proving the limitations of admission-time defenses against coordinated poisoning in RAG systems. It provides a clear geometric explanation for why these defenses fail and offers empirical evidence across multiple settings, urging the community to adopt more robust, multi-stage security strategies.
The paper proposes a theoretical and empirical analysis of a specific class of defenses (admission-time filtering) against coordinated poisoning attacks in Retrieval-Augmented Generation (RAG) systems. The core methodology involves defining a "coordinated adversary" that injects multiple individually unremarkable documents that collectively dominate the retrieval of a target query. The authors prove a fundamental limit for ingestion-time defenses, showing that the geometric distribution of embeddings (anisotropy) makes adversarial cones indistinguishable from legitimate niche content to any defense relying solely on document and sentinel statistics. They validate this with a constructed attack using HotFlip and demonstrate its effectiveness end-to-end with BGE-large and Qwen2.5-7B. The approach is rigorous, combining geometric arguments with empirical verification across multiple encoders and corpora.
The experiments are comprehensive and well-designed. The authors evaluate the attack on BEIR datasets using BGE-large and HNSW, demonstrating high success rates (10/10 slots seized). They test the robustness of the attack against various collective defenses (burst detection, co-retrieval statistics) and show a persistent residual. They also generalize the findings across five different encoders and two corpora. The end-to-end evaluation with a large language model confirms the practical harm (88% success in emitting planted claims). The statistical analysis, including the use of a gradient-boosted classifier to test the indistinguishability hypothesis, adds significant weight to the claims.
The paper provides sufficient detail for reproduction, including the encoder models (BGE-large, MiniLM, etc.), the vector store (HNSW), the LLM (Qwen2.5-7B), and the attack method (HotFlip). The datasets (BEIR collections) are public. The authors mention releasing artifacts, though no specific URL is provided in the text. The experimental setup is clearly described, allowing for independent verification.
The primary limitation is the scoped nature of the proof, which applies only to ingestion-time defenses that do not observe retrieval-time demand or provenance. The paper acknowledges that defenses using provenance or retrieval-time monitoring can bypass this limit. Additionally, the attack requires a white-box threat model regarding the encoder and gate parameters, although the authors argue this is a conservative assumption for the class of defenses studied. The evaluation is static and does not account for dynamic corpus updates or drift.
This paper has significant implications for the security of RAG systems. It challenges the assumption that admission-time filtering is sufficient for securing vector stores against sophisticated adversaries. It shifts the focus towards retrieval-time and provenance-based defenses. The findings are crucial for practitioners building secure RAG pipelines, highlighting the need for multi-layered security approaches. It also contributes to the broader understanding of adversarial robustness in high-dimensional embedding spaces. This paper makes a significant contribution to the field of AI security by rigorously proving the limitations of admission-time defenses against coordinated poisoning in RAG systems. It provides a clear geometric explanation for why these defenses fail and offers empirical evidence across multiple settings, urging the community to adopt more robust, multi-stage security strategies.
Existing agent benchmarks ask whether the agent finished the task. We ask whether it finished it within policy. We introduce Fiducia-bench, a benchmark for the governability of financial agents---whether they escalate when obligated, abstain when required, and leave an auditable trail---and use it to study a question no prior benchmark addresses: does decomposing an agent into components degrade its governance? It does, and the mechanism is specific. Policy-relevant facts discovered by one component are attenuated at the handoff boundary before reaching the component that must act on them. In a 626-episode experiment across 100 KYC/AML task variants, two models, and three architectures, a 32B open-weights model attenuated 0% of discovered facts under a single-loop baseline, 56% under a fixed pipeline, and 85% under an orchestrator-subagent architecture (all at constraint distance 2). A stronger model (gpt-4.1-mini) attenuated 3-6% under the same conditions, suggesting the governance cost of decomposition is partly a function of model capability. Critically, the same mechanism produces both under-escalation and over-escalation, depending on whether the dropped fact was a risk signal or an exculpating one. The benchmark, all tasks, and the verification harness are open-source
Primary: Unknown
All Institutions: Unknown
[One sentence main contribution]. [This paper empirically demonstrates that decomposing agents into components degrades policy compliance through fact attenuation at handoff boundaries, introducing Fiducia-bench to measure this governability gap and revealing that the effect is model-capability dependent, with implications for the safe deployment of multi-agent systems in regulated domains].
The paper proposes a rigorous empirical study on the "governability" of decomposed agent architectures. The methodology is sound and well-controlled: it isolates architectural decomposition (single-loop vs. fixed pipeline vs. orchestrator-subagent) as the independent variable while holding models, tools, and policy packs constant. The introduction of "Fiducia-bench" with machine-checkable policy packs and deterministic verification via trajectory replay is a strong methodological contribution. The metric "fact attenuation" is clearly defined and directly addresses the mechanism of failure (information loss at handoff boundaries). The use of paired mirror tasks (under-escalation vs. over-escalation) to prevent gaming is a clever experimental design choice.
The experiments are extensive (626 episodes) and cover multiple models (Qwen2.5-32B, gpt-4.1-mini) and architectures. The results are clear and statistically significant in their trend: decomposition degrades governance, and the effect is model-capability dependent. The finding that the same mechanism (attenuation) leads to opposite governance failures (under/over-escalation) depending on the nature of the dropped fact is a significant empirical insight. The comparison between P0 (full context) and P1 (retrieval) effectively rules out policy access mode as the primary driver, strengthening the claim about architectural decomposition.
The paper claims open-source release of the benchmark, tasks, and verification harness. The deterministic nature of the environment (seeded JSON store) and the pure-function metrics ensure that results are reproducible. The detailed description of the topology paragraphs and policy packs allows for exact replication of the experimental setup. The use of deterministic verification (replaying trajectory against fresh environment) enhances reproducibility compared to LLM-judged benchmarks.
The primary limitation is the scale of the models tested. The 32B model shows severe degradation, while the "stronger" model (gpt-4.1-mini, likely a smaller or mid-tier model given the naming convention and low attenuation rates) shows minimal degradation. The authors explicitly state they have not shown the effect holds at frontier-model scale (e.g., GPT-4o, Claude Opus). This leaves a critical gap: is this a problem for current open-weight models that is solved by future frontier models, or is it a fundamental architectural flaw that persists? The domain is also limited to KYC/AML, which may not generalize to other agent domains. The "scripted simulator" limitation suggests the tasks are somewhat narrow in scope.
This paper has significant implications for the deployment of multi-agent systems in regulated industries (finance, healthcare, legal). It challenges the engineering assumption that decomposition improves capability without cost to compliance. It provides a framework for auditing agent governance that is more robust than current LLM-judge methods. The findings could lead to new best practices for handoff protocols and interface design in multi-agent systems. [One sentence main contribution]. [This paper empirically demonstrates that decomposing agents into components degrades policy compliance through fact attenuation at handoff boundaries, introducing Fiducia-bench to measure this governability gap and revealing that the effect is model-capability dependent, with implications for the safe deployment of multi-agent systems in regulated domains].
Most LLM-based automated algorithm design methods optimize a designated component within a human-specified scaffold, fixing overall organization and component interactions. We present ATLAS, an embedding-guided quality-diversity framework for scaffold-free full-algorithm synthesis in combinatorial optimization. The problem specification supplies objectives and constraints; a minimal I/O interface fixes only instance and solution formats; the LLM chooses and restructures components, interactions, and control flow. This freedom enlarges the search space, risking invalid candidates and premature convergence to one design region. ATLAS independently detects execution, interface, and feasibility failures, recomputes objectives, and applies error-conditioned repair; similarity-based archive management preserves algorithms across embedding-space regions to counter premature convergence. Its three-layer search refines the best design, gives other regions dedicated refinement opportunities, and performs cross-region synthesis to recombine components and their interactions. Across four NP-hard problems, ATLAS outperforms several state-of-the-art component-synthesis methods and a matched full-synthesis baseline while remaining competitive with strong human-designed algorithms. One ATLAS run retains several algorithms with comparable performance from distinct embedding-space regions rather than a single design. Code inspection finds that these multi-component designs differ in their primary construction or global-search backbone. Our results suggest that embedding-guided quality-diversity search can make the enlarged full-algorithm design space practically searchable. Source code and exact executable prompts are available at
Primary: RMIT University
All Institutions: RMIT University, University of Leeds, La Trobe University, Effective AI
ATLAS introduces a scaffold-free, embedding-guided quality-diversity framework for synthesizing complete optimization algorithms with LLMs, demonstrating that preserving semantic diversity in the search space leads to competitive performance against specialized human-designed methods and prior LLM-based synthesis approaches.
The paper proposes ATLAS, a framework for scaffold-free full-algorithm synthesis using Large Language Models (LLMs). The core innovation lies in combining LLM-based code generation with a Quality-Diversity (QD) optimization strategy guided by semantic embeddings. Unlike previous methods that synthesize components within fixed scaffolds (e.g., FunSearch, EoH), ATLAS allows the LLM to design the entire algorithm structure, control flow, and component interactions. The method employs a three-layer search strategy: (1) refining the current best algorithm, (2) maturing representatives from diverse embedding-space clusters, and (3) cross-region synthesis to recombine components. It also introduces an error-conditioned repair mechanism to handle the high failure rate associated with generating complete, executable algorithms. The approach is technically sound, addressing the specific challenges of the expanded search space (execution errors, feasibility violations) through rigorous evaluation and repair protocols.
The authors evaluate ATLAS on four NP-hard combinatorial optimization problems: CVRP, CVRPTW, Flow Shop Scheduling, and Quadratic Assignment Problem. They compare against strong human-designed baselines (e.g., PyVRP, OR-Tools, RoTS) and state-of-the-art LLM-based synthesis methods (ReEvo, EoH, MCTS-AHD). The results indicate that ATLAS outperforms component-synthesis methods and a matched full-synthesis baseline (EoH-Full). Crucially, ATLAS remains competitive with specialized human-designed algorithms, which is a significant achievement for automated algorithm design. The ablation studies on the three-layer search and embedding guidance provide evidence for the effectiveness of the proposed QD strategy. The evaluation is rigorous, including statistical testing and generalization checks on held-out test instances.
The paper provides source code and exact executable prompts in a public GitHub repository. The experimental setup is detailed, including problem instances, runtime caps, and LLM configurations. The use of fixed seeds for data splits and independent runs enhances reproducibility. The inclusion of failure diagnostics and lineage tracking in the codebase further supports reproducibility.
The primary limitation is the computational cost. LLM-based synthesis is expensive, and the three-layer search with embedding computations adds overhead. The performance of ATLAS is still generally below the best human-designed solvers (e.g., OR-Tools for CVRP), although it is competitive. The method relies on the capability of the underlying LLM (GPT-4o-mini in this case); improvements in LLMs would likely yield better results, suggesting the method is an effective wrapper rather than a fundamentally new algorithmic paradigm for the optimization problems themselves. The embedding space is a proxy for semantic similarity and may not perfectly capture functional equivalence or optimality.
This work contributes to the field of Automated Machine Learning (AutoML) and Automated Algorithm Design. By demonstrating that scaffold-free synthesis is feasible and effective with QD search, it opens up new avenues for discovering novel algorithmic structures that human designers might overlook. It reduces the reliance on expert knowledge for algorithm design. The potential for discovering hybrid algorithms through cross-region synthesis could lead to new state-of-the-art heuristics for various optimization domains. ATLAS introduces a scaffold-free, embedding-guided quality-diversity framework for synthesizing complete optimization algorithms with LLMs, demonstrating that preserving semantic diversity in the search space leads to competitive performance against specialized human-designed methods and prior LLM-based synthesis approaches.
The popular CART algorithm for regression trees combines a greedy splitting rule with a stopping rule, but while the splitting rule has been well studied, the statistical role of stopping rules is less well understood. Meanwhile, although regression trees fit using Bayesian methods or via empirical risk minimization (ERM) have been shown to be spatially adaptive to local smoothness and anisotropy, it is unknown whether CART can achieve the same adaptation. We address these gaps by proving that, under spatially heterogeneous and anisotropic smoothness and appropriate structural assumptions on the regression function and covariate distribution, CART with the minimum impurity decrease (MID) stopping rule and a suitable threshold achieves pointwise rates that are minimax up to logarithmic factors. These rates hold simultaneously over all points in the domain. Moreover, we prove that spatial adaptation cannot be achieved under the widely used minimum leaf size stopping rule. Together, these results establish a precise statistical role for the MID stopping rule and provide a theoretical basis for the empirical success of CART.
Primary: National University of Singapore
All Institutions: National University of Singapore
This paper makes a significant theoretical contribution to statistical learning by rigorously characterizing the minimax optimality of CART with the MID stopping rule under spatially heterogeneous smoothness, while proving the inadequacy of the minimum leaf size rule, thereby resolving a key gap in the understanding of classical tree-based methods.
The paper employs rigorous mathematical analysis within the framework of nonparametric regression and statistical learning theory. It investigates the statistical properties of the Classification and Regression Trees (CART) algorithm, specifically focusing on the role of stopping rules. The methodology involves proving minimax optimal pointwise rates for CART using the Minimum Impurity Decrease (MID) stopping rule under spatially heterogeneous and anisotropic smoothness assumptions. It also establishes a negative result (lower bound) showing that the Minimum Leaf Size stopping rule fails to achieve spatial adaptation. The approach is theoretically dense, relying on concentration inequalities and approximation theory to derive upper and lower bounds.
The paper includes a section on experiments, though the primary contribution is theoretical. The experiments likely serve to validate the theoretical findings or demonstrate the practical implications of the stopping rules in finite-sample regimes. Given the nature of the theoretical claims, empirical validation is secondary but necessary to show that the asymptotic results hold in practice. The evaluation appears consistent with standard practices in statistical learning theory papers, focusing on convergence rates and error bounds rather than benchmarking against deep learning state-of-the-art.
The paper provides a full text with sections on preliminaries, proofs, and experiments. The theoretical derivations are explicit, allowing for verification by other researchers. The code for the experiments is not explicitly linked in the provided text, but the algorithms (CART variants) are standard. The reproducibility of the theoretical results is high, while the reproducibility of specific experimental plots depends on the availability of the code, which is not guaranteed by the text alone. However, the mathematical framework is self-contained.
The primary limitation is the scope of the theoretical assumptions. The results hold under specific structural assumptions on the regression function and covariate distribution. While these are reasonable for establishing minimax rates, they may not capture all real-world data complexities. Additionally, the paper focuses on CART, a classical algorithm, and does not extend the analysis to modern ensemble methods like Random Forests or Gradient Boosting, although the insights may inform them. The "logarithmic factors" in the minimax rates are a common caveat in tree-based theory but still represent a gap from exact optimality.
This paper provides a crucial theoretical foundation for understanding why CART works well in practice, specifically addressing the often-overlooked role of the stopping rule. By establishing the statistical role of the MID stopping rule, it offers guidance for practitioners and researchers on how to tune tree-based models for optimal statistical performance. It bridges the gap between the empirical success of CART and its theoretical underpinnings, potentially influencing the design of future tree-based algorithms and the theoretical analysis of greedy splitting methods. This paper makes a significant theoretical contribution to statistical learning by rigorously characterizing the minimax optimality of CART with the MID stopping rule under spatially heterogeneous smoothness, while proving the inadequacy of the minimum leaf size rule, thereby resolving a key gap in the understanding of classical tree-based methods.
The growing ecosystem of large language models (LLMs) offers huge potential to optimize performance-cost trade-offs. However, their heterogeneous capabilities and inference costs make efficiently routing queries a significant challenge. Existing paradigms are inflexible: one-shot routers commit before observing responses, whereas conventional cascades stop adaptively but follow a fixed model order. Cascade routing removes both restrictions by reconsidering whether to stop or invoke another model after each response. Current methods use a predict-then-optimize pipeline estimating response quality and future model utility. However, prediction loss for quality or utility is not equivalent to routing-decision loss. A lower prediction error does not necessarily yield a better action; a small boundary-crossing error can reverse a ``stop'' or model-selection decision. Therefore, we propose RLCascadeRouter, a quality-estimator-free framework that formulates cascade routing as a Markov decision process with actions comprising ``stop'' and model selection. It uses trajectory returns and advantages to directly optimize the performance-cost objective. Its Cascade Policy Network models candidate complementarity for model selection and remaining-action value for stopping, eliminating independent post-hoc response-quality estimators. Evaluated across ten LLMRouterBench benchmarks with thirteen LLMs, RLCascadeRouter outperforms strong baselines and achieves superior performance-cost trade-offs. It incorporates unseen models without retraining, and ablation studies validate both policy components.
Primary: The Hong Kong Polytechnic University
All Institutions: The Hong Kong Polytechnic University, Zhejiang University
RLCascadeRouter presents a practical reinforcement learning approach to LLM cascade routing that directly optimizes performance-cost utility, addressing the limitations of quality-estimator-based methods. While the theoretical motivation is sound and the empirical results are competitive, the method relies on standard RL techniques and incremental architectural changes, limiting its overall novelty and transformative impact on the field.
The paper proposes RLCascadeRouter, a reinforcement learning framework for LLM cascade routing. The core theoretical argument is the "Prediction-Decision Mismatch," positing that minimizing quality estimation error does not minimize routing decision error. To address this, the authors formulate the problem as an MDP and use PPO to directly optimize a performance-cost utility function. The architecture consists of a Complementarity Encoder (CE) to model interactions between remaining models and a Value-Aware Stopper (VAS) to decide between stopping and continuing. The methodology is sound and follows established RL patterns (PPO, Transformer-based encoders). However, the novelty is moderate; the concept of using RL for routing exists (e.g., TREACLE, Router-R1), and the specific "predict-then-optimize" critique is well-known in the context of structured prediction and decision-focused learning. The implementation details are standard, relying on textual embeddings and simple MLP/Transformer heads, without significant architectural innovation.
The evaluation is conducted on LLMRouterBench, covering 10 benchmarks and 13 LLMs. The results show that RLCascadeRouter outperforms strong baselines like Avengers-Pro and FrugalGPT in terms of performance-cost trade-offs. The Pareto frontier analysis is a strong point, demonstrating the flexibility of the approach. The generalization experiment (unseen models) is also valuable, showing that the policy can adapt to new models using only textual descriptions. However, the cost metric reported in the tables (e.g., 180.22 for RLCascadeRouter vs 6.98 for Qwen3-235B single model) appears to be a normalized or arbitrary unit rather than actual API cost, which makes direct economic interpretation difficult without further clarification. The improvement over baselines is consistent but not revolutionary; the gains are marginal in many settings.
The paper provides detailed hyperparameters for the PPO training (learning rate, batch size, epochs) and describes the network architecture (hidden dim, layers, attention heads). The state representation and action masking logic are clearly defined. The use of textual model descriptions for generalization is reproducible. However, the specific "Query-Model Prior" calculation and the exact normalization of the cost metric are somewhat opaque. The lack of public code or a clear link to a repository reduces immediate reproducibility.
The paper does not discuss the computational overhead of training the RL policy compared to training a simple classifier/router. The reliance on textual descriptions for unseen models assumes that these descriptions accurately reflect capabilities, which may not always be the case. The "cost" metric is normalized, making it hard to assess real-world savings. The approach is offline-trained; its performance in online, dynamic environments where model costs or capabilities change is speculative.
This work contributes to the efficient deployment of LLMs, potentially reducing inference costs and latency for large-scale applications. By providing a framework that adapts to heterogeneous model pools, it encourages the use of smaller, cheaper models for simpler tasks, aligning with sustainability goals in AI. RLCascadeRouter presents a practical reinforcement learning approach to LLM cascade routing that directly optimizes performance-cost utility, addressing the limitations of quality-estimator-based methods. While the theoretical motivation is sound and the empirical results are competitive, the method relies on standard RL techniques and incremental architectural changes, limiting its overall novelty and transformative impact on the field.
Agentic applications are shifting AI serving from isolated model inference to long-running workloads in which LLMs coordinate tools, environments, and persistent state. However, the system behavior of these workloads---where latency, cost, and bottlenecks arise---remains poorly characterized, leaving serving systems to rely on assumptions built for conventional inference. We present AgentSysBench, a benchmark suite and measurement toolkit with ten representative agentic applications and unified systems-level instrumentation. Across controlled deployments and production traces, we identify six properties that distinguish agentic workloads from conventional LLM serving: (1) execution is heavyweight and stateful, with non-LLM components dominating latency in 5 of 10 applications and sandbox working-set memory peaking at 28 GB per session; (2) applications compose components with heterogeneous resource affinity---GPU-bound inference, memory-bound retrieval, CPU-bound sandboxes---whose task latencies diverge by up to 32x; (3) bottlenecks shift across requests, models, and deployments; (4) production sessions hold state idle for minutes to hours between active steps; (5) a control-plane tax---auxiliary LLM calls and context overhead from tool schemas and observations---crowds out productive compute and context; and (6) production traces from three applications reveal heavy cross-request redundancy in search queries and web fetches, exposing a large caching opportunity. Four design explorations demonstrate that these findings are actionable: task-aware serving reduces latency by 29--40%, communication-aware placement by up to 4.5x, state offloading reduces memory usage by 4.6x, and tool-result caching removes 35.2% of redundant search calls and saves 19.3% of aggregate search latency.
Primary: Hong Kong University of Science and Technology
All Institutions: Hong Kong University of Science and Technology, Alibaba Group, Bytedance
The paper makes a timely and valuable contribution to the field of AI systems by rigorously characterizing the unique demands of agentic workloads and demonstrating actionable optimizations.
The paper proposes a systematic characterization of "agentic workloads," distinguishing them from standard LLM inference tasks. The methodology involves creating AgentSysBench, a benchmark suite comprising ten representative agentic applications, and deploying them in both controlled environments and production settings. The core technical contribution is the empirical identification of six distinct properties of these workloads: heavyweight stateful execution, heterogeneous resource affinity (GPU/CPU/memory), dynamic bottleneck shifting, long idle-but-live intervals, control-plane tax (overhead from tool schemas/auxiliary calls), and cross-request redundancy. The authors then present four design explorations (task-aware serving, communication-aware placement, state offloading, tool-result caching) to demonstrate that these insights lead to tangible system improvements. The approach is rigorous, combining trace analysis with system-level instrumentation.
The evaluation is comprehensive, covering controlled deployments and production traces from three applications. Key findings include non-LLM components dominating latency in 50% of apps, sandbox memory peaking at 28GB, and task latencies diverging by up to 32x. The design explorations show significant gains: 29-40% latency reduction with task-aware serving, 4.5x improvement with communication-aware placement, 4.6x memory reduction with state offloading, and ~35% reduction in redundant search calls via caching. These results are substantial and directly address the identified bottlenecks. The use of production traces adds significant weight to the findings compared to synthetic benchmarks.
The authors state that the benchmark suite and serving stack will be released as open source. The paper provides detailed descriptions of the instrumentation and the six properties identified. However, as an arXiv preprint, the code is not yet available in the text. The methodology is clearly described, suggesting high reproducibility once the code is released. The inclusion of production traces (though likely anonymized or aggregated) provides a solid basis for validation.
The study focuses on ten applications, which may not capture the full diversity of agentic patterns. The production traces are from only three applications, potentially limiting the generalizability of the redundancy findings. The "control-plane tax" analysis is specific to the tool-use frameworks evaluated. The design explorations are preliminary ("demonstrate that these findings are actionable") rather than fully optimized systems, so the reported gains might not be achievable in all contexts. The focus is on serving systems, so it does not address model-centric optimizations for agents.
This paper has significant implications for the AI infrastructure community. As agentic AI becomes more prevalent, understanding the system-level characteristics of these workloads is crucial for building efficient, scalable, and cost-effective serving platforms. The findings challenge the assumption that LLM serving is primarily about GPU-bound inference, highlighting the importance of CPU, memory, and I/O resources. The identified caching opportunities and state management strategies can lead to substantial cost savings and latency improvements for real-world agent deployments. The paper makes a timely and valuable contribution to the field of AI systems by rigorously characterizing the unique demands of agentic workloads and demonstrating actionable optimizations.
Demand forecasting increasingly requires combining two complementary sources of information: historical sales reveal recurring numerical dynamics, while future promotions, holidays, price changes, and platform interventions provide forward-looking knowledge. Existing text-enhanced forecasting methods often encode such context into generic representations and fuse it uniformly with time-series features, without explicitly distinguishing which semantic effects are forecast-relevant or how they should modify future dynamics. We introduce ReasonCast, a structured semantic intervention framework that translates event knowledge into forecast-specific operations. An agent examines the event context, the no-text forecast, and its uncertainty to determine whether textual reasoning is needed. Rather than injecting free-form text, ReasonCast represents event knowledge through structured fields describing event relevance, demand direction, temporal shape, amplitude, and peak intensity. These fields interact selectively with temporal components of a time-series foundation model. An additive path corrects local trends and temporal shapes, while a multiplicative path captures event-driven level shifts. ReasonCast introduces a forecast-grounded post-training curriculum. Schema SFT establishes semantic fields; semantic-field RL calibrates direction, shape, amplitude, and peak judgments; and forecast-utility RL evaluates semantic interventions through a frozen forecaster, aligning reasoning outputs with marginal forecast improvement. ReasonCast lowers WMAPE by 3.29, 1.25, and 0.47 percentage points on holiday-sensitive categories, mega-sale-sensitive categories, and M5 event windows, respectively. On stable-sales periods, indiscriminate semantic intervention increases WMAPE by 1.68 percentage points, whereas suppressing unnecessary intervention preserves the numerical backbone.
Primary: Alibaba Group
All Institutions: Alibaba Group
Analysis unavailable
The paper proposes ReasonCast, a framework that integrates Large Language Models (LLMs) with Time-Series Foundation Models (TSFMs) for demand forecasting. The core innovation lies in treating textual event information not as a direct input token, but as a structured "semantic intervention." The method employs an agentic router to decide whether to intervene, and if so, extracts structured fields (direction, shape, amplitude, etc.). These fields are projected into an orthogonal subspace of the TSFM's temporal representations, allowing for additive and multiplicative corrections. The training curriculum is sophisticated, involving Schema SFT, semantic-field RL, and forecast-utility RL (using a frozen forecaster to evaluate marginal gain). The approach is technically sound, addressing the common failure mode of LLMs degrading numerical forecasts by enforcing an "exact no-text identity" when the agent chooses to skip.
The evaluation is conducted on a large-scale proprietary Alibaba commerce dataset and the public M5 benchmark. The results show significant improvements in WMAPE on holiday-sensitive and mega-sale-sensitive categories compared to strong baselines like Chronos-2 and Time-LLM. Crucially, the paper demonstrates that the model does not degrade performance on stable-sales periods due to the selective routing mechanism. The ablation studies are thorough, dissecting the contribution of orthogonal decomposition, adaptive gating, and the specific RL stages. The inclusion of a "semantic inversion" stress test adds robustness to the claims that the model relies on semantic content rather than spurious correlations.
The paper provides detailed descriptions of the architecture, loss functions, and training curriculum. However, the use of a proprietary dataset limits independent verification of the primary results. The reliance on a specific LLM (Qwen3-32B) and TSFM (Chronos-2) is noted, but the code for the proprietary data processing is not available. The methodology for the RL stages is described, but hyperparameters and specific reward scaling factors are likely sensitive and may require careful tuning to reproduce.
The primary limitation is the reliance on proprietary data for the main claims. The paper acknowledges that tool-augmented reasoning introduces latency and cost trade-offs, which are not fully quantified in terms of operational efficiency. The "orthogonal subspace" assumption is geometric but may not perfectly align with causal semantic factors. Additionally, the performance gain on the M5 dataset is modest compared to the proprietary data, suggesting the method's value is highly dependent on the quality and specificity of the event context provided.
This work represents a significant step towards practical, agentic AI systems in enterprise settings, specifically in supply chain and retail. By demonstrating how to safely integrate unstructured text insights into numerical forecasting models without degrading baseline performance, it provides a blueprint for multimodal AI deployment. The emphasis on "forecast-utility" RL over mere "plausibility" of text is a valuable conceptual shift for the field.
In formal verification, both the autoformalization of statements and automated proof search have been studied extensively. While automated proof search can produce a formal proof that compiles, the generated proof does not necessarily reflect how the natural-language argument arrives at its conclusion--a property we refer to as faithfulness. With faithfully formalized proofs, one can check the reasoning behind a human- or AI-written argument, and assist mathematicians in formalizing their proof sketches. However, it is particularly challenging due to misalignment of formal proof tactics and natural language reasoning. In this work, we rigorously describe a set of five necessary conditions a faithful formal proof must satisfy, and introduce Pistis, an agentic, oracle-guided proof search that produces formal Lean proofs that satisfy them. At its core is a novel faithfulness-preserving divide-and-conquer search, which we name OrderDecompose, that tracks citation dependencies and blocks unfaithful shortcuts, paired with a refutation search, that surfaces gaps and errors in the natural language proof source. OrderDecompose completes proofs that baselines cannot close even within a 12-hour budget, and its artifacts compile over 33$\times$ as fast as prior work's. We apply Pistis on the first three books of Euclid's Elements, producing high-quality artifacts containing faithful formal proofs. Under a blinded human study and an LLM-as-a-judge protocol on rigorous rubrics, Pistis-generated proofs are favored over prior works--2.89$\times$ and 5.2$\times$ as often by human reviewers and the LLM judge, respectively. It further uncovers gaps in Euclid's proofs and their translation, and can accept or refute natural language proofs written by humans or AI, demonstrating that faithful formalization is useful as a proof-checking tool.
Primary: University of British Columbia
All Institutions: University of British Columbia, Amazon
[One sentence main contribution]. [This paper presents Pistis, an agentic proof search system that enforces faithfulness in formalizing mathematical proofs, demonstrated through rigorous evaluation on Euclid's Elements, offering a new paradigm for aligning automated reasoning with human mathematical intuition.]
The paper introduces "Pistis," an agentic framework for the autoformalization of mathematical proofs, specifically targeting the property of "faithfulness"—ensuring that the formal Lean proof mirrors the logical structure of the natural language argument. The core technical contribution is the "OrderDecompose" algorithm, a faithfulness-preserving divide-and-conquer search strategy that tracks citation dependencies to prevent unfaithful shortcuts. It also incorporates a refutation search mechanism to identify gaps in the source text. This represents a significant methodological shift from standard autoformalization, which often prioritizes provability over structural alignment with human reasoning.
The evaluation is conducted on Euclid's Elements (Books I-III), a standard benchmark for formalization. The results indicate that Pistis outperforms baselines in both speed (33x faster compilation) and faithfulness (2.89x favored by humans, 5.2x by LLM judges). The ability to uncover gaps in Euclid's proofs adds a layer of utility beyond simple verification. However, the scope is limited to a specific domain (classical geometry) and a relatively small dataset compared to modern large-scale LLM benchmarks.
The paper describes the algorithmic components (OrderDecompose, refutation search) in detail. The use of Lean as the formal system provides a standardized environment. While code availability is not explicitly confirmed in the text provided, the methodological description is sufficient for replication by experts in the field.
The primary limitation is the domain specificity. Euclid's Elements, while foundational, lacks the complexity and abstraction of modern higher mathematics (e.g., algebraic geometry or analysis). The reliance on LLM-as-a-judge for faithfulness metrics, while supported by human validation, introduces potential bias. The "faithfulness" metric itself is subjective and difficult to quantify perfectly, as noted by the authors' need for human study.
This work addresses a critical bottleneck in formal verification: the gap between machine-proven correctness and human understandable reasoning. By enabling faithful formalization, it facilitates the use of formal methods as a tool for mathematical discovery and education, rather than just a verification oracle. It bridges the gap between AI theorem proving and mathematical practice. [One sentence main contribution]. [This paper presents Pistis, an agentic proof search system that enforces faithfulness in formalizing mathematical proofs, demonstrated through rigorous evaluation on Euclid's Elements, offering a new paradigm for aligning automated reasoning with human mathematical intuition.]
Test-time compute can substantially improve Large Language Model (LLM) reasoning performance, yet how and when additional compute helps remains poorly understood. We study Divergent-Convergent Reasoning (DCR), a simple two-phase primitive consisting of an exploration phase that generates multiple candidate solutions followed by a convergent reconciliation phase. We present three core results. First, we show that even a single reconciliation step can reliably amplify correct minority reports: across datasets, DCR often recovers the correct answer when correct exploration outputs are in the minority, a regime where majority voting fails. Second, we introduce recursive DCR, an autoregressive reconciliation system that iteratively analyzes disagreements and allocates additional test-time compute. Recursive DCR achieves higher accuracy than fixed-compute baselines-reaching 93.3% on AIME 2024 and 92.0% on AIME 2025-while using roughly 27% less compute on average, demonstrating that attentive resource allocation is superior to uniform scaling. Third, we analyze disagreement among exploration outputs via a simple, training-free dispersion metric. Dispersion reveals a structured relationship between disagreement and test-time gains: in regimes where DCR is effective, higher disagreement among exploration outputs is associated with larger accuracy improvements from reconciliation. Together, these results show that disagreement, often viewed as noise, can be systematically exploited to improve test-time reasoning and reveal emerging scaling laws for agentic LLM systems.
Primary: Enkira
All Institutions: Queen's University, Enkira, IBM T.J. Watson Research Center, University of Chicago, Tensormesh Inc.
This paper presents a compelling empirical study of Divergent-Convergent Reasoning, demonstrating that structured reconciliation of diverse solutions can significantly outperform majority voting and fixed-compute baselines on challenging reasoning tasks. The introduction of recursive DCR with a unanimous-consent stopping rule and the analysis of dispersion as a diagnostic for task difficulty provide valuable insights for the field of test-time compute scaling, offering a practical and effective method for improving LLM reasoning reliability without requiring additional training.
The paper proposes Divergent-Convergent Reasoning (DCR), a two-phase inference-time primitive. Phase 1 generates diverse candidate solutions via sampling (divergence). Phase 2 employs a "reviewer" LLM to analyze disagreements and synthesize a reconciled answer (convergence). The authors extend this to a recursive variant where reconciliation rounds continue until unanimous agreement or a budget is exhausted. The core methodological contribution is the structural separation of generation and critical review, leveraging the hypothesis that selection is easier than generation. The approach is conceptually similar to "Tree of Thoughts" or "Self-Consistency" but emphasizes the *analysis of disagreement* rather than just voting. The "unanimous-consent" stopping rule is a simple but effective heuristic for adaptive compute allocation. The methodology is sound and builds on established multi-agent/ensemble reasoning paradigms, though it lacks a fundamentally new algorithmic breakthrough, relying instead on empirical characterization of an existing primitive.
The evaluation covers four challenging benchmarks: MATH500, AIME 2024, AIME 2025, and MMLU-PRO. The results are strong, particularly on AIME 2024 (93.3%) and AIME 2025 (92.0%) using GPT-OSS-120B. The paper demonstrates that DCR outperforms majority voting and fixed-compute baselines, especially in regimes where the correct answer is a minority report. The analysis of "dispersion" as a proxy for task difficulty is a valuable empirical insight, identifying a "sweet spot" for compute allocation. The comparison to ReConcile and other peer-discussion methods highlights the superiority of the reviewer-style reconciliation. The experiments are rigorous, with multiple trials and clear metrics (Trial Accuracy and Consistency). However, the reliance on proprietary models (GPT-OSS, Llama-4) limits direct reproducibility for some readers, although the prompts are provided.
The paper provides detailed prompts for both exploration and reconciliation phases. It defines the dispersion metric formally. However, the use of specific proprietary models (GPT-OSS-120B, Llama-4-Maverick) and the lack of open-source code or weights for the "reviewer" component (if distinct from the generator) pose challenges. The "Llama-4" reference suggests this is a very recent or potentially future-dated paper (given the "ICML 2026" footer and "AIME 2025" dataset), which might imply the data is from a pre-release or internal benchmark, potentially affecting generalizability. The code is not linked.
The paper acknowledges limitations such as the "cold start" cost of dispersion estimation and the risk of "confident hallucination" in low-dispersion regimes. It also notes that mixing proposals from heterogeneous models can sometimes pollute stronger models. The unanimous-consent stopping rule may be overly conservative, potentially wasting compute on hard problems that never converge. The reliance on large language models for the reconciliation step means the method is not truly "free" of compute costs, though it is more efficient than uniform scaling.
The work has significant implications for the deployment of LLMs in reasoning-critical domains. By demonstrating that test-time compute can be allocated adaptively and that disagreement is a useful signal, it provides a framework for building more robust and efficient AI systems. The potential for high-confidence errors remains a risk, but the proposed dispersion metric offers a mitigation strategy. The findings contribute to the broader understanding of how ensemble methods and test-time scaling laws operate. This paper presents a compelling empirical study of Divergent-Convergent Reasoning, demonstrating that structured reconciliation of diverse solutions can significantly outperform majority voting and fixed-compute baselines on challenging reasoning tasks. The introduction of recursive DCR with a unanimous-consent stopping rule and the analysis of dispersion as a diagnostic for task difficulty provide valuable insights for the field of test-time compute scaling, offering a practical and effective method for improving LLM reasoning reliability without requiring additional training.
Egocentric video offers scalable manipulation data for embodied AI, yet recovering metric 3D hand trajectories remains challenging due to severe object occlusion and frequent out-of-sight gaps. Existing single-frame and windowed temporal regressors fail when hand shortly leaves the frame, while recent video diffusion models (VDMs) rely on heavy, stochastic multi-step sampling as pixel-space renderers. We instead repurpose VDM into a deterministic geometry encoder. A single forward pass over the clean latent exposes scene content beyond current observations, including occluded and out-of-sight hands. We introduce DreamHand, an offline clip-level framework that extracts features via a Deterministic Clean-Latent Encoder and decodes them with a Bidirectional Spatiotemporal Decoder. DreamHand recovers continuous bimanual trajectories with metric placement and no external detector, while a Ray-Based Camera Solver supports a second configuration that needs no test-time camera intrinsics. Across five egocentric benchmarks, DreamHand sets a new state of the art, cutting MPJPE-p by 30% on occlusion-heavy ARCTIC and 40% on HOT3D. These gains reach 46%-61% once out-of-sight hands are included in the evaluation, offering a scalable path from everyday human video to robot manipulation data.
Primary: Unknown (Paper text does not list author affiliations)
All Institutions: Unknown
DreamHand introduces a novel paradigm for 3D hand pose estimation by repurposing Video Diffusion Models as deterministic, efficient geometry encoders, achieving state-of-the-art performance on egocentric benchmarks while enabling intrinsics-free operation and handling severe occlusions through bidirectional temporal reasoning.
The paper proposes "DreamHand," a framework that repurposes a pretrained Video Diffusion Model (VDM), specifically Wan 2.2, as a deterministic geometry encoder rather than a generative renderer. The core innovation lies in extracting features from the "clean latent" (zero noise) via a single forward pass, which is significantly more efficient than iterative sampling. The architecture includes a Bidirectional Spatiotemporal Decoder that uses spatially grounded queries and unconstrained bidirectional attention to recover continuous bimanual trajectories, handling severe occlusions and out-of-sight (OOS) hands by leveraging temporal context. Additionally, a Ray-Based Camera Solver predicts a viewing-ray field to enable intrinsics-free ($K$-free) metric placement, decoupling hand motion from camera dynamics. The approach is technically sound, leveraging the strong spatiotemporal priors of VDMs while avoiding their inference latency. The integration of LoRA adapters for end-to-end adaptation of the VDM features to 3D geometry is a clever and effective strategy.
The evaluation is comprehensive, covering five major egocentric hand pose benchmarks: ARCTIC, HOT3D, HOI4D, H2O, and OakInk2. DreamHand sets new state-of-the-art results, significantly outperforming baselines like ViDiHand, HaMeR, and WiLoR, particularly in metrics penalizing false negatives (MPJPE-p) and out-of-sight recovery (MPJPE+OOS). The paper provides detailed ablation studies validating the components: the necessity of VDM features over discriminative encoders (V-JEPA, VideoMAE), the effectiveness of the bidirectional decoder, and the viability of the intrinsics-free solver. The results are robust, showing consistent improvements across diverse datasets with varying occlusion levels and camera setups. The efficiency gain (63 fps vs 1.9 fps for ViDiHand) is a significant practical advantage.
The paper provides extensive implementation details, including architecture specifications, loss functions, training hyperparameters, and dataset preprocessing steps. The appendix contains detailed protocol definitions and baseline reproduction notes, enhancing transparency. However, the primary institution and author affiliations are missing from the provided text, which is unusual for a final paper but common for arXiv preprints. The code repository URL is not explicitly provided in the text snippet, though the mention of "released input and output channel counts" suggests an intent to release code. The detailed description of the mixed-PnP solver and ray field prediction allows for reasonable reproduction by experts in the field.
The method operates offline on full clips, limiting its applicability to real-time, closed-loop robotic control without further distillation or architectural changes. The intrinsics-free solver's performance degrades at image peripheries, as noted in the ablation studies. The reliance on pseudo-ground-truth annotations for HOI4D and H2O means some reported gains might reflect agreement with noisy labels rather than absolute metric accuracy. The generalization of the predicted ray field is best within camera families seen during training, suggesting a potential limitation in cross-domain deployment without fine-tuning.
This work bridges the gap between large-scale generative video models and precise 3D perception tasks. By demonstrating that VDMs can serve as powerful, efficient geometry encoders, it opens new avenues for leveraging generative priors in discriminative 3D vision tasks. The ability to recover metric 3D hand motion from egocentric video with high robustness to occlusion and without camera calibration has significant implications for embodied AI, robot learning, and augmented reality. It provides a scalable path for generating high-quality manipulation data from everyday videos, potentially accelerating the development of dexterous robotic systems. DreamHand introduces a novel paradigm for 3D hand pose estimation by repurposing Video Diffusion Models as deterministic, efficient geometry encoders, achieving state-of-the-art performance on egocentric benchmarks while enabling intrinsics-free operation and handling severe occlusions through bidirectional temporal reasoning.
Vision encoders are a critical component of vision-language models, and scaling their capacity effectively improves performance. However, dense scaling increases compute cost and inference latency. Mixture-of-Experts (MoE) architectures offer a compelling alternative, having enabled efficient scaling in LLMs, yet the MoE design space for CLIP-style vision encoders remains underexplored at State-of-the-Art (SOTA) levels. In this work, we systematically study MoE designs for vision encoder scaling and find that fine-grained MoE topologies yield substantial gains over both dense and standard MoE counterparts. We further propose an auxiliary-loss-free balancing variant for better expert utilization, and design a specialized MoE kernel to mitigate inference latency overhead. To enhance video capabilities while preserving image knowledge, we introduce frame-level distillation paired with a novel freezing mechanism. We pretrain a series of Mixture-of-Experts Vision Encoders (MoE-ViE) across a range of sizes, all consistently outperforming their dense counterparts. Our largest model matches the zero-shot performance of a SOTA encoder 1.7x its size at 76% of its latency. When aligned with an LLM, MoE-ViE surpasses all compared encoders on image and video benchmarks, including those with up to 5x more activated parameters. Code is available at https://github.com/facebookresearch/moe_vie.
Primary: Meta
All Institutions: Meta
MoE-ViE presents a comprehensive and effective framework for scaling vision encoders using Mixture-of-Experts, achieving state-of-the-art efficiency and accuracy through fine-grained architectures, novel load balancing, and hardware-aware kernel optimizations.
The paper proposes MoE-ViE, a Mixture-of-Experts vision encoder designed to scale capacity without linearly increasing inference latency. The core methodological contributions include: 1) Fine-grained expert topologies (smaller hidden widths per expert) compared to standard dense-to-MoE replacements; 2) A magnitude-aware, loss-free load balancing mechanism using z-score updates to router biases, avoiding auxiliary loss perturbations; 3) A specialized Triton-based MoE kernel implementing Grouped GEMM and kernel fusion to mitigate memory-bound bottlenecks; 4) A robust video finetuning strategy combining frame-level distillation and MLP freezing to prevent catastrophic forgetting of image representations. The approach is technically sound and addresses specific pain points in scaling CLIP-style models (latency vs. capacity trade-off and cross-modal forgetting).
The authors conduct extensive experiments across multiple scales (B, L, H) on zero-shot image classification (ImageNet, ImageNet-A, etc.), retrieval, and video understanding benchmarks. They demonstrate that MoE-ViE consistently outperforms dense counterparts of similar active compute budgets and matches or exceeds SOTA dense models (like SigLIP2-g-opt and PEcoreG) with significantly fewer active parameters. Latency benchmarks on H100 GPUs confirm the efficiency gains from the custom kernel. The ablation studies are thorough, covering expert granularity, balancing strategies, and finetuning components. The results are compelling and align with the claims.
The paper provides detailed architectural specifications, training schedules, and hyperparameters. The code is made available via a GitHub link. The description of the custom Triton kernel is sufficiently detailed for reproduction by practitioners familiar with low-level GPU optimization. The use of standard datasets (ImageNet, Kinetics, etc.) ensures comparability.
The paper relies heavily on proprietary data ("1.5B proprietary data") for pretraining, which limits the ability of external researchers to fully replicate the training conditions. The performance gains are significant but incremental in the context of the broader VLM landscape, where data quality and scale often dominate over architectural nuances. The "loss-free" balancing, while effective, may be sensitive to the specific z-score scaling factors chosen, though the paper argues for robustness. The focus is primarily on image/video encoding; the impact on the LLM decoder side is limited to the encoder's output quality.
This work provides a practical blueprint for scaling vision encoders efficiently, which is crucial for deploying large VLMs in resource-constrained environments. By demonstrating that MoE can outperform dense models in vision tasks when properly optimized (architecture + kernel), it challenges the assumption that dense models are always superior for vision. The video finetuning strategy is also broadly applicable to unified vision-language models. MoE-ViE presents a comprehensive and effective framework for scaling vision encoders using Mixture-of-Experts, achieving state-of-the-art efficiency and accuracy through fine-grained architectures, novel load balancing, and hardware-aware kernel optimizations.
Chain-of-thought reasoning has substantially improved the problem-solving capabilities of multimodal large language models. Fine-grained visual evidence, however, remains difficult to preserve and reuse across text-based reasoning steps. To address this limitation, tool-augmented thinking-with-images methods maintain visual access externally by revisiting or manipulating the image, but require predefined tools and additional inference-time processing. As an internal alternative, continuous visual latent reasoning retains intermediate computation in hidden states. However, its prevailing autoregressive construction makes each latent state depend on its predecessors, so later states may repeat information already present in the latent sequence rather than capture complementary visual details. We introduce GLaQ, a grounded latent-query framework that replaces sequential latent rollout with a fixed set of context-conditioned queries grounded in the original visual tokens. The grounded queries are reinjected for answer generation, providing direct and coordinated access to source visual evidence. We train GLaQ with localized-view supervision followed by reinforcement learning under task-level rewards. Across five benchmarks for fine-grained visual understanding and perception, GLaQ-7B gains 5.99--9.66\% over its base model and leads all compared visual latent methods, suggesting that direct query-to-image grounding can recover localized evidence from the full image without external visual operations or autoregressive latent rollouts.
Primary: Unknown
All Institutions: Unknown
GLaQ introduces a grounded latent-query framework that effectively replaces autoregressive latent rollout with direct, context-conditioned grounding in visual tokens, demonstrating significant improvements in fine-grained visual reasoning benchmarks.
The paper proposes GLaQ, a framework that replaces autoregressive latent rollout in multimodal large language models (MLLMs) with a fixed set of context-conditioned queries grounded directly in original visual tokens. The core innovation lies in the "contextualize--ground--reinject" pipeline: a Latent Query Former (LQFormer) grounds learnable query slots in the source image features, avoiding the information bottleneck and redundancy issues associated with sequential latent generation. The training methodology combines supervised fine-tuning with ROI-guided self-distillation (using an EMA teacher on cropped views) and Reinforcement Learning via Decoupled Policy Optimization (DePO) to optimize both text and continuous latent actions. This approach is technically sound and addresses a specific, well-identified limitation in current visual latent reasoning methods (autoregressive dependency leading to information collapse).
The evaluation covers five benchmarks for fine-grained visual understanding (V^, HRBench-4K/8K, MME-RealWorld-Lite, MMVP). GLaQ-7B shows consistent improvements over its Qwen2.5-VL-7B base model (+5.99--9.66%) and outperforms other visual latent methods (LVR, SkiLa, Monet, HyLaR) and thinking-with-images methods (ZoomEye, Thyme, DeepEyes). The ablation studies are thorough, isolating the contributions of the LQFormer, the EMA teacher, and the RL stage. The efficiency analysis also demonstrates that GLaQ improves the accuracy-efficiency frontier compared to baselines. The results are strong and support the claims, although the comparison is primarily against open-source baselines and a few proprietary models, with no direct comparison to the latest SOTA proprietary models like GPT-4o in terms of absolute performance ceiling, though relative gains are reported.
The paper provides detailed descriptions of the architecture (LQFormer, two-pass forward), training stages (SFT with ROI distillation, RL with DePO), and hyperparameters (K=16, latent weight=0.3). It mentions using VLMEvalKit for evaluation and reproducing baselines. While code is not explicitly linked, the methodological details are sufficient for reproduction by researchers in the field. The use of standard backbones (Qwen2.5-VL) and datasets aids reproducibility.
The evaluation is limited to a single 7B backbone model. The method relies on auxiliary localized-view supervision during training, which may not be available for all tasks or datasets. The fixed number of query slots (K=16) is a hyperparameter that requires tuning; the paper notes that K=32 can lead to redundancy. The method does not scale the number of queries dynamically based on task complexity. The paper does not discuss potential negative societal impacts, though the technology is generally beneficial for AI capabilities.
GLaQ contributes to the advancement of multimodal AI by enabling more efficient and accurate visual reasoning without external tools. This can lead to more robust AI systems for applications requiring fine-grained visual perception, such as medical imaging analysis, autonomous driving, and detailed document understanding. By improving the efficiency of latent reasoning, it also reduces computational costs compared to tool-augmented methods. GLaQ introduces a grounded latent-query framework that effectively replaces autoregressive latent rollout with direct, context-conditioned grounding in visual tokens, demonstrating significant improvements in fine-grained visual reasoning benchmarks.
Maintaining global geometric consistency is a central challenge in long-sequence 3D reconstruction, with scale drift being the most critical failure mode. In chunk-based inference pipelines, the scale degree of freedom in sequential Sim(3) alignment is left unconstrained, causing estimation errors to compound multiplicatively and distort global trajectories and point cloud geometry. We present a scale-consistency enhancement framework built on a key insight: in structured environments such as driving scenes, geometric quantities arising from environmental regularity remain inherently invariant across temporal segments, and discrepancies in their per-chunk measurements directly expose inter-chunk scale drift. We propose Scene Geometric Invariant Anchoring (SGIA), which extracts dominant geometric invariants from each chunk's predicted point cloud via coarse-to-fine robust estimation and exploits their cross-chunk consistency to establish scale constraints independent of point cloud registration, explicitly degenerating 7-DoF Sim(3) alignment into 6-DoF rigid-body transformation and severing chain-wise scale error propagation at its source. We further introduce a lightweight test-time adaptation strategy that fine-tunes only normalization-layer parameters via multi-objective self-supervision, progressively improving intra-chunk predictions along the sequence. Both modules are plug-and-play and require no offline retraining. Experiments on multiple long-sequence benchmarks demonstrate state-of-the-art performance, reducing absolute trajectory error by up to 32% with significant gains in trajectory stability and reconstruction quality. Code: https://github.com/WZ-CS/VGGT-Align
Primary: Northwestern Polytechnical University
All Institutions: Northwestern Polytechnical University
The paper presents a robust and practical solution to scale drift in long-sequence 3D reconstruction, combining geometric priors with test-time adaptation to achieve state-of-the-art results on major benchmarks.
The paper addresses the critical issue of scale drift in chunk-based long-sequence 3D reconstruction pipelines, specifically those built on feed-forward models like VGGT. The core methodological contribution is Scene Geometric Invariant Anchoring (SGIA), which leverages the physical invariance of scene structures (ground plane distance and road width) to constrain the scale factor in Sim(3) alignment, effectively degenerating it to SE(3). This is a clever, physics-informed heuristic that decouples scale estimation from the noisy overlap-based registration. The secondary contribution is a lightweight Test-Time Adaptation (TTA) strategy that fine-tunes only normalization layers to handle distributional shifts across long sequences. The methodology is sound, well-motivated, and technically elegant in its simplicity, avoiding the need for complex retraining or external sensors.
The experimental evaluation is extensive and convincing. The authors benchmark VGGT-Align on KITTI Odometry, Waymo Open Dataset, and Virtual KITTI. They demonstrate state-of-the-art performance among calibration-free methods, significantly outperforming baselines like VGGT-Long and SwiftVGGT. The reduction in Absolute Trajectory Error (ATE) is substantial (up to 32% on KITTI). The inclusion of reconstruction quality metrics (Chamfer Distance, Accuracy) on Waymo further validates the geometric consistency improvements. The ablation studies clearly isolate the contributions of SGIA and TTA. The runtime analysis confirms that the added computational overhead is negligible.
The paper provides a GitHub repository link and describes the methodology in sufficient detail for reproduction. The use of standard datasets (KITTI, Waymo) and clear baselines enhances reproducibility. The TTA protocol is well-defined. However, the reliance on specific geometric priors (ground plane, road width) requires careful implementation of the RANSAC/SVD pipeline described, which is standard but non-trivial to get robustly right in all conditions.
The primary limitation is the assumption of "structured environments" with dominant planar structures (ground, roads). The method's performance may degrade in unstructured environments (e.g., forests, dense urban canyons with no clear ground plane, or indoor scenes with varied floor plans) where the geometric invariants are not consistent or detectable. The paper acknowledges this with a fallback mechanism but does not extensively evaluate performance in such non-structured domains. Additionally, the TTA strategy, while lightweight, introduces a sequential dependency that could accumulate errors if the adaptation gets stuck in a local optimum, although the authors argue this is mitigated by the frozen backbone.
This work has significant implications for autonomous driving and large-scale mapping, where long-sequence, metric-scale consistent 3D reconstruction is essential. By providing a plug-and-play solution that improves the reliability of feed-forward 3D vision models without retraining, it lowers the barrier to deploying these efficient models in real-world, long-duration applications. It bridges the gap between the efficiency of feed-forward models and the robustness required for SLAM-like tasks. The paper presents a robust and practical solution to scale drift in long-sequence 3D reconstruction, combining geometric priors with test-time adaptation to achieve state-of-the-art results on major benchmarks.
Long-context modeling is a pivotal capability for Large Language Models, yet the quadratic complexity of attention remains a critical bottleneck, particularly during the compute-intensive prefilling phase. Our previous work, FlashPrefill, mitigates this cost through instantaneous pattern discovery and max-based dynamic thresholding; however, it remains an algorithmic prototype that is still distant from production deployment. In this paper, we present FlashPrefill V2, which evolves FlashPrefill from a prototype toward practical long-context serving along three dimensions. First, we introduce a mean correction term that effectively suppresses the approximation error, keeping performance degradation manageable even at extreme sparsity levels. Second, we redesign the sparse attention operator with PackGQA memory access, warp specialization, and pingpong pipelining, fully aligning with the latest FlashAttention-3/4 implementations and supporting FP8 inference to meet practical quantization requirements. Third, FlashPrefill V2 natively supports paged KV cache and continuous batching, allowing integration as an attention backend in modern inference frameworks such as SGLang. Extensive evaluations on NVIDIA H20 GPUs---among the most widely deployed inference accelerators---demonstrate that FlashPrefill V2 delivers up to 47.26x and 27.19x speedups over FlashAttention-2 at 128K context length under FP8 and BF16 precision, respectively, and, in FP8, still achieves a 30.49x speedup against an FA3/4-aligned dense baseline.
Primary: Tencent WeChat
All Institutions: Tencent WeChat
FlashPrefill V2 presents a substantial systems-level contribution to long-context LLM serving by transforming a sparse attention prototype into a production-ready, highly optimized backend that achieves massive speedups on widely deployed hardware through advanced kernel engineering and integration with modern inference frameworks.
The paper proposes FlashPrefill V2, an optimization for the prefilling phase of Long-Context LLM serving. It builds upon a previous prototype (FlashPrefill) by introducing three key technical components: 1) A mean correction term to reduce approximation error in block-sparse attention, allowing for higher sparsity without significant accuracy loss. 2) A highly optimized CUDA kernel implementation leveraging PackGQA memory access, warp specialization, and ping-pong pipelining, aligned with FlashAttention-3/4 paradigms and supporting FP8 inference. 3) Integration support for paged KV cache and continuous batching, making it a viable backend for modern inference engines like SGLang. The methodology is sound and addresses a critical bottleneck (prefill latency) in long-context serving. The shift from algorithmic prototype to production-ready system is a significant engineering contribution. EXPERIMENTAL_EVALUTION: The evaluation is conducted on NVIDIA H20 GPUs, which are noted as widely deployed inference accelerators. The paper reports substantial speedups: up to 47.26x over FlashAttention-2 (FA2) at 128K context under FP8, and 27.19x under BF16. It also compares against an FA3/4-aligned dense baseline, showing a 30.49x speedup in FP8. The results demonstrate clear performance gains. However, the paper lacks detailed accuracy benchmarks (e.g., perplexity drops on standard datasets) beyond the claim that error is "manageable." The focus is heavily on throughput/latency, which is appropriate for a systems paper, but a more rigorous accuracy analysis would strengthen the claim of "practical" deployment.
The paper describes specific kernel optimizations (warp specialization, ping-pong pipelining) and integration points (SGLang). While the algorithmic description is clear, the full source code is not explicitly linked in the abstract or provided in the text snippet. Reproducibility depends on the availability of the code repository, which is not extracted here. The use of standard hardware (H20) and frameworks (SGLang) aids reproducibility if code is open-sourced.
The primary limitation is the reliance on block-sparse attention, which introduces approximation error. While the mean correction helps, it does not eliminate it, potentially affecting tasks requiring precise attention mechanisms. The evaluation is limited to NVIDIA H20 GPUs; performance on other architectures (e.g., H100, A100, or AMD GPUs) is not reported. The paper does not provide extensive accuracy degradation analysis across diverse benchmarks. The "extreme sparsity levels" mentioned in the abstract are not quantified in the provided text, making it hard to assess the trade-off curve.
This work has significant potential impact on the efficiency of long-context LLM serving, reducing costs and latency for applications requiring large context windows. By aligning with modern inference frameworks and supporting FP8, it promotes energy-efficient and cost-effective deployment of large models. The focus on production-ready systems bridges the gap between academic research and industrial application. FlashPrefill V2 presents a substantial systems-level contribution to long-context LLM serving by transforming a sparse attention prototype into a production-ready, highly optimized backend that achieves massive speedups on widely deployed hardware through advanced kernel engineering and integration with modern inference frameworks.
Modern multimodal foundation models (MFMs) have made rapid progress on tasks requiring integrated perception across speech, vision, and language, including emotion recognition. However, it remains unclear whether they recognize speech and facial emotion through shared affective functional units or modality-specific pathways. We explore emotion-sensitive neurons (ESNs), sparse decoder neurons selectively associated with emotion categories, in three MFMs: Gemma-4-12B-it, MiniCPM-o-4.5, and Qwen2.5-Omni-7B. Using speech emotion recognition and facial expression recognition as complementary probes, we identify acoustic and visual ESNs. Visual ESNs are causally meaningful: deactivating them selectively impairs recognition of the associated facial emotion, whereas steering their activations selectively enhances recognition of that emotion relative to other emotion categories. Acoustic and visual ESNs further show emotion-matched overlap and similar layer-wise distributions, indicating partial structural alignment between affective representations across speech and faces. Finally, cross-modal interventions reveal bidirectional causal transfer: ESNs identified from one modality produce emotion-specific effects when applied to the other. Our findings provide one of the first cross-modality activation-level analyses of affective functional units in MFMs, suggesting that speech and facial emotion recognition partially converge onto sparse decoder-level components that can be localized and manipulated without training.
Primary: Johns Hopkins University
All Institutions: Johns Hopkins University, Imperial College London
This paper makes a significant contribution to mechanistic interpretability by demonstrating sparse, cross-modal alignment of affective functional units in multimodal foundation models, providing the first causal evidence that speech and facial emotion recognition share underlying decoder-level components.
The paper employs a rigorous mechanistic interpretability pipeline applied to modern Multimodal Foundation Models (MFMs). The methodology involves identifying Emotion-Sensitive Neurons (ESNs) in decoder MLPs using a contrastive activation margin (ConAct) on correctly classified samples. The core technical contribution is the extension of this probe from speech (prior work) to vision (facial expressions) and, crucially, the cross-modal transfer of these neuron masks. The approach of deactivating and steering specific neurons to test causal necessity and sufficiency is well-established in interpretability but its application to cross-modal affective alignment in large-scale open-weight MFMs is novel. The use of multiple-choice protocols with randomized option orders helps mitigate positional and label bias, a strong methodological detail.
The experiments are comprehensive, covering three distinct MFMs (Gemma-4, MiniCPM-o, Qwen2.5-Omni) and two datasets (MSP-Podcast for SER, AffectNet for FER). The results demonstrate that: 1) Visual ESNs are causally meaningful (deactivation impairs, steering enhances FER); 2) Acoustic and Visual ESNs show sparse but significant overlap and similar layer-wise distributions; 3) Cross-modal transfer works bidirectionally, though with varying strength. The statistical controls (random masks, self-cross gaps) are appropriate. The findings are consistent and robust across models, suggesting a genuine structural alignment in how these models handle affective information.
The paper provides sufficient detail for reproduction. It specifies the models, datasets, sampling sizes (150 utterances/300 images), decoding parameters (greedy, temp 0), and the specific intervention methods (deactivation/steering of SwiGLU gates). The use of open-source models and standard datasets enhances reproducibility. The code is not explicitly linked in the text provided, but the methodology is clear enough to implement.
The overlap between acoustic and visual ESNs is described as "sparse" and "small" (Jaccard similarity). While statistically significant, the practical implication of such sparse overlap is limited. The analysis is confined to decoder MLPs; encoder-level or cross-attention mechanisms are not probed, which might contain earlier modality-specific or fusion-related affective signals. The "neutral" emotion category shows weaker effects, which is noted but not deeply explored. The cross-modal transfer effects, while present, are modest compared to mono-modal effects, suggesting that the "shared" units are a small subset of the total representational capacity.
This work provides critical insights into the internal workings of multimodal AI systems, specifically regarding affective computing. It suggests that MFMs are developing somewhat unified representations for emotion across modalities, which has implications for model robustness, bias, and controllability. Understanding these shared mechanisms could lead to better debiasing techniques or more consistent emotion recognition systems. However, the ability to manipulate emotions via neuron steering also raises safety concerns regarding the potential for malicious manipulation of AI-generated emotional content. This paper makes a significant contribution to mechanistic interpretability by demonstrating sparse, cross-modal alignment of affective functional units in multimodal foundation models, providing the first causal evidence that speech and facial emotion recognition share underlying decoder-level components.
Stateful language agents assume a rejected branch can be taken back by clearing it from the application transcript. We show this breaks when the serving session retains key/value (KV) state across the logical abort: the model can continue attending to content the application believes it discarded. We formalize the missing guarantee as rollback consistency: a complete abort must restore the state the model attends, not just the transcript. The key failure is cross-layer: a correct logical rollback need not compose with retained inference state, and the gap can remain invisible to the application. To isolate cache effects from text effects, we introduce a same-token/different-cache audit that holds decision-step tokens identical while varying only whether the cached prefix is stale or rebuilt from committed state. Across seven open-weight families (3.8B-36B), retained KV alone flips a typed protected effect in 25 of 63 audited cells, while attacker tokens are absent from the served request in all 63; rebuilding the cache closes every cell. The channel reproduces in an end-to-end session application, on the default Hugging Face Transformers cache-reuse path, and under LangGraph time-travel, where verified logical rollback can still leave attended KV stale. Susceptibility varies across models, but the underlying attended-state integrity violation is structural. We rule out position and length confounds, generalize across protected effects, policy structures, and a cache-isolated Mixture-of-Experts model, and show that transaction-local cache restoration closes the channel without requiring a global cache flush. All headline results are deterministic and reproducible from released artifacts.
Primary: The Hong Kong University of Science and Technology
All Institutions: The Hong Kong University of Science and Technology
The paper presents a compelling and technically rigorous audit of KV-cache retention in language agents, demonstrating a novel cross-layer vulnerability where logical rollbacks fail to restore the model's attended state, leading to security violations. Its methodological innovation in isolating cache effects and its comprehensive empirical validation across multiple models and frameworks make it a significant contribution to AI security and systems research.
The paper introduces a rigorous causal audit methodology called "same-token/different-cache" to isolate the effect of retained Key/Value (KV) cache state from textual context. By holding the decision-step tokens identical across executions while varying only the provenance of the cached prefix (stale retained branch vs. fresh rebuild), the authors successfully isolate a cross-layer inconsistency. This methodology is technically sound and provides a novel way to audit inference engines for state integrity, moving beyond simple prompt injection tests to examine the composition of application logic and serving infrastructure.
The experimental evaluation is comprehensive and robust. The authors test across seven open-weight model families (3.8B-36B), covering a wide range of architectures and sizes. They employ a deterministic grid of 63 attack cells, varying injection vehicles (tool returns, retrieved docs, user turns) and residue strengths. The results are striking: retained KV alone flips protected effects in 25/63 cells, while the attacker tokens are provably absent from the served request. The paper further validates these findings in end-to-end session applications and using first-class rollback APIs like LangGraph, demonstrating that the vulnerability is not an artifact of low-level tensor manipulation but a systemic issue in how agent frameworks compose with serving layers. The inclusion of length/position-matched controls rules out confounding variables, strengthening the causal claim.
The paper emphasizes reproducibility, stating that all headline results are deterministic (greedy decoding) and reproducible from released artifacts. The authors provide a detailed reproducibility statement, including code for the audit adapters, end-to-end apps, and specific probes. The use of sealed JSON records and SHA-256 checksums for inputs adds a layer of trust to the reported metrics. The deterministic nature of the experiments (temperature 0) ensures that the results are exact censuses rather than statistical estimates, enhancing reliability.
The primary limitation is that the vulnerability requires a specific configuration: a retained session/KV handle across a logical abort. Content-addressed caches (like vLLM's default) are noted as exempt because they do not re-inject removed tokens. Additionally, the exploitability is model-dependent; some models (e.g., Phi-4, Seed-OSS-36B) were resistant to the Layer-2 effect flip, although the Layer-1 state violation persisted. The paper also notes that commercial provider-hidden caches were not probed, leaving their susceptibility unknown. Finally, the threat model assumes the attacker controls content in a rejected branch, which is a specific and somewhat constrained scenario compared to general prompt injection.
This paper has significant implications for the security and reliability of stateful language agents. It exposes a fundamental gap in the compositional guarantees of current agent frameworks and serving engines. By formalizing "rollback consistency," it provides a new security property that the community must address. The proposed fix (transaction-local cache restore) is practical and low-cost, offering a clear path for mitigation. This work shifts the focus from prompt-level security to system-level state integrity, encouraging developers and framework authors to audit their cache management strategies. It highlights that logical correctness (correct transcript) does not imply physical correctness (correct model attention), a critical insight for building trustworthy AI systems. The paper presents a compelling and technically rigorous audit of KV-cache retention in language agents, demonstrating a novel cross-layer vulnerability where logical rollbacks fail to restore the model's attended state, leading to security violations. Its methodological innovation in isolating cache effects and its comprehensive empirical validation across multiple models and frameworks make it a significant contribution to AI security and systems research.
We introduce Accelerating Dexterity via Pre-Training (ADEPT), a large-scale reinforcement learning (RL) framework for learning sim-to-real transferable dexterity across high degree-of-freedom (DoF) robot embodiments that can solve long-horizon tasks directly from raw visuo-tactile perception. ADEPT pretrains a dexterous policy on a generic object reposing task, then post-trains downstream policies with this pretrained behavior as a prior. ADEPT enables learning new behaviors that are otherwise difficult to discover from scratch on multi-fingered robots and avoids learning the same set of skills over again for every new downstream task. The pretrained policy zero-shots the reposing phase of downstream tasks, but naïve RL fine-tuning rapidly degrades this capability during transfer. We address this with a stable post-training recipe combining behavior-cloning distillation, critic warm-up, and conservative on-policy updates. To safely exploit the full kinematic dexterity, we introduce a joint-space Geometric Fabric that mediates between the RL policy and the robot. We distill post-trained teachers into perceptive students that zero-shot sim-to-real transfer on two embodiments: a 23 DoF Kuka-Allegro with two RGB cameras, and a 29 DoF Flexiv-Sharpa with two RGB cameras and five vision-based tactile sensors, and can solve long-horizon tasks from challenging initial states with dexterity at human-level speed.
Primary: University of Toronto
All Institutions: University of Toronto, Vector Institute, NVIDIA
The paper presents a significant advancement in dexterous manipulation via RL, introducing a robust pre-training and post-training framework that enables stable and efficient learning of complex manipulation skills. The combination of behavioral cloning distillation, critic warm-up, and conservative updates effectively mitigates the instability often associated with fine-tuning RL policies, while the Geometric Fabric ensures safe and feasible control. The successful sim-to-real transfer on multiple high-DoF platforms demonstrates the practical utility and generalizability of the approach, making it a valuable contribution to the field of robotics and reinforcement learning.
The paper introduces ADEPT, a framework for learning dexterous manipulation policies using Reinforcement Learning (RL). The core methodological contribution is a two-stage training pipeline: 1) Pre-training a policy on a generic "reposing" task to learn basic object handling and kinematic feasibility, and 2) Post-training (fine-tuning) on specific downstream tasks. Crucially, the authors address the issue of "catastrophic forgetting" or instability during fine-tuning by introducing a stable recipe combining behavior cloning (BC) distillation, critic warm-up, and conservative on-policy updates. They also introduce a "Geometric Fabric" in the joint space to mediate between the RL policy and the robot, ensuring safe and feasible control. The approach leverages large-scale simulation data and transfers to real-world embodiments (Kuka-Allegro and Flexiv-Sharpa). The methodology is sound and addresses a significant bottleneck in dexterous manipulation: the difficulty of discovering complex manipulation skills from scratch via RL.
The evaluation is extensive and rigorous. The authors demonstrate zero-shot sim-to-real transfer on two distinct high-DoF robotic platforms. They show that ADEPT enables the robots to solve long-horizon tasks (like object reposing and manipulation) from challenging initial states. The results indicate that the pre-training phase significantly accelerates learning and improves the stability of the post-training phase compared to training from scratch. The comparison against baselines (likely standard RL or BC-only approaches) highlights the effectiveness of the proposed post-training recipe. The ability to transfer to real hardware without further tuning is a strong empirical result.
The paper provides detailed descriptions of the simulation environment, the robot models, and the training hyperparameters. The code is made available on GitHub, and the project website includes demo videos. The use of standard simulators (Isaac Gym) and well-known robot models enhances reproducibility. The authors explicitly discuss the limitations and the specific conditions under which the method works, aiding in replication.
The method relies heavily on high-quality simulation-to-real transfer, which can still be sensitive to domain gaps not captured in simulation (e.g., friction variations, sensor noise). The "Geometric Fabric" adds a layer of complexity to the control stack. The pre-training on a generic task requires careful design to ensure the learned priors are useful for diverse downstream tasks. The computational cost of pre-training on large-scale RL data is significant.
This work contributes to the advancement of general-purpose robotic manipulation, a key step towards more autonomous and versatile robots in unstructured environments. By making dexterous manipulation more accessible via RL, it lowers the barrier for research and application in this domain. The open-source release of code and models promotes further research and development in the field. The paper presents a significant advancement in dexterous manipulation via RL, introducing a robust pre-training and post-training framework that enables stable and efficient learning of complex manipulation skills. The combination of behavioral cloning distillation, critic warm-up, and conservative updates effectively mitigates the instability often associated with fine-tuning RL policies, while the Geometric Fabric ensures safe and feasible control. The successful sim-to-real transfer on multiple high-DoF platforms demonstrates the practical utility and generalizability of the approach, making it a valuable contribution to the field of robotics and reinforcement learning.